Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A company is designing a federated identity solution to allow developers to access resources across multiple member accounts in an AWS Organization. The company has a centralized, OpenID Connect (OIDC) compliant Identity Provider (IdP) containing all developer user identities. A solutions architect needs to establish trust between the IdP and the IAM roles in each member account.

Which of the following actions must the solutions architect take in each member account to configure this federated trust relationship? (Select TWO.)

  1. Create an IAM OpenID Connect (OIDC) identity provider that uses the issuer URL of the corporate IdP and specifies the client ID as the audience.Cevap
  2. Create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action for the IAM OIDC provider principal.Cevap
  3. C
    Create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action and specifies the corporate OIDC identity provider as the principal.
  4. D
    Apply a Service Control Policy (SCP) to the member accounts that grants permissions to the OIDC provider, replacing the need for local IAM role trust policies.

Cevap

To configure the federated trust relationship using OIDC, the solutions architect must create an IAM OIDC identity provider using the corporate IdP's issuer URL and client ID, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action for the OIDC provider principal.
To establish federation with an external OpenID Connect (OIDC) Identity Provider across multiple AWS accounts, two main steps must be taken in each target member account. First, an IAM OIDC identity provider must be created in the target account to establish trust with the corporate IdP using its issuer URL and client ID. Second, an IAM role must be created in the target account with a trust policy that allows the sts:AssumeRoleWithWebIdentity action for the OIDC provider principal. This allows the corporate IdP's users to exchange their OIDC token for temporary AWS credentials using the Security Token Service (STS).

Adım Adım Çözüm

1
Configure the OIDC provider in the member accounts.
An IAM OIDC identity provider is established in each target account to recognize tokens from the external corporate IdP.
AWS must trust the external identity provider before any federated identities can perform actions or assume roles.
2
Create the target IAM roles and set their trust policies.
IAM roles are created with trust policies specifying the OIDC provider as a principal and allowing sts:AssumeRoleWithWebIdentity.
This allows the OIDC federated users to call the AWS STS service to assume the roles using OIDC tokens.

Anahtar Kavram

Establishing OpenID Connect (OIDC) federation across a multi-account AWS environment by configuring IAM OIDC providers and role trust policies using the sts:AssumeRoleWithWebIdentity action.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru