Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A technology firm is configuring single sign-on access to its AWS member accounts using an external SAML 2.0 Identity Provider (IdP). An administrator has successfully configured the external IdP and created a SAML provider entity in the target AWS account. However, when users try to log in, they receive an error stating that the federated role cannot be assumed. Which configuration is required in the target AWS account to resolve this issue?

  1. Configure the trust policy of the target IAM role to list the SAML provider's Amazon Resource Name (ARN) as the principal and specify the sts:AssumeRoleWithSAML action.Cevap
  2. B
    Configure the trust policy of the target IAM role to use the external IdP's metadata URL as the principal and specify the standard sts:AssumeRole action.
  3. C
    Attach a Service Control Policy (SCP) to the target account's Organizational Unit (OU) that explicitly grants sts:AssumeRoleWithSAML access to the external identity provider.
  4. D
    Configure the target IAM role's trust policy to trust the management account of the organization and use sts:AssumeRoleWithWebIdentity to federate the SAML users.

Cevap

Configure the trust policy of the target IAM role to list the SAML provider's Amazon Resource Name (ARN) as the principal and specify the sts:AssumeRoleWithSAML action.
The correct configuration is to define the trust relationship on the target IAM role to trust the SAML provider entity's Amazon Resource Name (ARN) in IAM, and to allow the sts:AssumeRoleWithSAML action. This allows the Security Token Service (STS) to validate the SAML assertion and issue temporary security credentials.

Adım Adım Çözüm

1
Identify the authentication protocol being used.
SAML 2.0 protocol is used for federation.
Selecting the correct AWS Security Token Service (STS) action requires knowing whether SAML 2.0 or OIDC is in use.
2
Verify the role trust policy configuration requirements.
The target role trust policy must specify the SAML provider ARN as the principal and allow sts:AssumeRoleWithSAML.
This establishes trust between the external identity provider (represented by the SAML provider in IAM) and the IAM role that users will assume.

Anahtar Kavram

SAML 2.0 Identity Federation Trust Policies
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru