Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

An enterprise manages multiple AWS accounts under AWS Organizations and has configured federation with an on-premises SAML 2.0 Identity Provider (IdP). Internal database administrators (DBAs) successfully authenticate with the IdP but receive an access denied error when attempting to assume the cross-account DBA role in target member accounts. A review of the configuration shows that the SAML provider object has been created in each target account. What configuration modification must the Solutions Architect apply to the target accounts to resolve this issue?

  1. A
    Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRole' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.
  2. B
    Create and attach a Service Control Policy (SCP) to the target accounts' Organizational Unit that explicitly grants 'sts:AssumeRole' permission to the SAML provider ARN.
  3. Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRoleWithSAML' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.Cevap
  4. D
    Update the IAM role trust policy in the target accounts to specify 'sts:AssumeRoleWithWebIdentity' as the Action and use the identity provider's external metadata URL directly in the Principal block.

Cevap

Update the IAM role trust policy in the target accounts to list the SAML provider ARN as the Principal, specify 'sts:AssumeRoleWithSAML' as the Action, and include a Condition checking that the 'SAML:aud' attribute matches 'https://signin.aws.amazon.com/saml'.
The correct configuration for SAML 2.0 federation requires the IAM role trust policy in the target account to list the SAML provider's ARN as the federated principal, specify the 'sts:AssumeRoleWithSAML' action, and validate the audience attribute ('SAML:aud') to point to the AWS SAML endpoint.

Adım Adım Çözüm

1
Identify the authentication and authorization mechanism in use.
The scenario describes SAML 2.0 federation where users authenticate at an external IdP and receive a SAML assertion to assume an IAM role in target AWS accounts.
This establishes that the target role's trust policy must allow federation via SAML.
2
Determine the required API action and principal for SAML 2.0 federation trust policies.
SAML-based federation requires the 'sts:AssumeRoleWithSAML' action and must trust the SAML provider ARN created in the target account.
Standard 'sts:AssumeRole' is for AWS IAM principals, and 'sts:AssumeRoleWithWebIdentity' is for OIDC providers.
3
Validate required conditions for SAML trust relationships.
A condition block must verify that the 'SAML:aud' (audience) attribute matches the AWS SAML endpoint 'https://signin.aws.amazon.com/saml'.
This prevents unauthorized endpoints from initiating session requests using the SAML assertion.

Anahtar Kavram

SAML 2.0 Multi-Account Federation IAM Trust Policies
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru