Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

An enterprise is migrating its identity architecture to a federated model. The solutions architect has established a SAML 2.0 federation between the corporate Identity Provider (IdP) and AWS Organizations. Users must federate directly into a shared services member AWS account and assume a specific role called NetworkEngineer to manage network resources. However, when users attempt to federate from the corporate portal, they receive an error indicating they are not authorized to perform the role assumption. Which configuration change is required to resolve this federation error?

  1. A
    Modify the trust policy of the NetworkEngineer role in the shared services account to allow the action sts:AssumeRole, and set the Principal to the external SAML provider's metadata URL.
  2. Update the trust policy of the NetworkEngineer role in the shared services account to allow the action sts:AssumeRoleWithSAML, and set the Principal to the ARN of the SAML provider created in the shared services account.Cevap
  3. C
    Create a Service Control Policy (SCP) that allows the sts:AssumeRoleWithSAML action, and attach it to the Organizational Unit containing the shared services account.
  4. D
    Configure the trust policy of the NetworkEngineer role in the shared services account to trust the root user of the AWS Organizations management account and allow the sts:AssumeRole action.

Cevap

Update the trust policy of the NetworkEngineer role in the shared services account to allow the action sts:AssumeRoleWithSAML, and set the Principal to the ARN of the SAML provider created in the shared services account.
For direct SAML 2.0 federation to succeed, the target IAM role's trust policy must explicitly trust the SAML provider created in that specific AWS account by referencing its ARN as the principal and permitting the sts:AssumeRoleWithSAML action.

Adım Adım Çözüm

1
Analyze the authentication error to determine the failure point.
The error indicates that the federated identity is not authorized to assume the role, pointing to an issue in the role's trust policy configuration.
Before troubleshooting individual claims, the trust relationship between the identity provider and the IAM role must be properly defined.
2
Configure the trust policy action for SAML federation.
The action in the IAM role trust policy is set to sts:AssumeRoleWithSAML.
Standard role assumption uses sts:AssumeRole, but SAML 2.0 identity federation requires the specific sts:AssumeRoleWithSAML action.
3
Define the trusted principal in the trust policy.
The Principal is set to Federated and references the ARN of the SAML provider resource inside the member account's IAM configuration.
AWS trust policies require an IAM SAML provider resource ARN as the principal to validate the SAML assertion sent by the IdP.

Anahtar Kavram

SAML 2.0 Role Trust Policy Configuration
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru