Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

An enterprise is configuring federated access to its multi-account AWS environment using an external SAML 2.0 Identity Provider (IdP). The Solutions Architect needs to establish trust and enable users authenticated by the external IdP to assume a specific read-only IAM role in multiple member accounts managed under AWS Organizations. Which of the following configuration steps are required to establish this federation trust relationship and allow users to access the member accounts? (Select TWO.)

  1. In each member account, create an IAM SAML identity provider using the SAML metadata document from the external IdP, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider ARN.Cevap
  2. Configure the external IdP to output SAML assertions that include the https://aws.amazon.com/SAML/Attributes/Role attribute mapping the IAM role ARN to the SAML provider ARN, and the https://aws.amazon.com/SAML/Attributes/RoleSessionName attribute.Cevap
  3. C
    In each member account, create an IAM role with a trust policy that allows the standard sts:AssumeRole action and sets the principal to the AWS SAML service endpoint URL.
  4. D
    Create a Service Control Policy (SCP) at the root of the AWS Organization that allows the sts:AssumeRoleWithSAML action, which automatically propagates the SAML identity provider metadata and roles to all member accounts.
  5. E
    Register the SAML identity provider only in the AWS Organizations management account, and configure member accounts to trust the management account's IAM service principal using sts:AssumeRole.

Cevap

In each member account, create an IAM SAML identity provider using the SAML metadata document from the external IdP, and create an IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider ARN; and configure the external IdP to output SAML assertions that include the https://aws.amazon.com/SAML/Attributes/Role attribute mapping the IAM role ARN to the SAML provider ARN, and the https://aws.amazon.com/SAML/Attributes/RoleSessionName attribute.
Establishing a SAML 2.0 federation to multiple member accounts requires configuring trust on both sides. On the AWS side, each member account must have a registered IAM SAML identity provider and an IAM role configured with a trust policy that references that provider and permits the sts:AssumeRoleWithSAML action. On the identity provider side, the IdP must issue assertions containing the mandatory AWS SAML attributes: the Role attribute (specifying the role and provider ARN pair) and the RoleSessionName attribute (providing a session identifier for logging).

Adım Adım Çözüm

1
Set up the identity trust inside the AWS member accounts.
An IAM SAML identity provider is created in each target account, establishing a cryptographic trust between AWS and the external IdP.
Each member account must recognize the external IdP as a trusted issuer of security assertions.
2
Create the IAM roles with trust policies referencing the SAML provider.
IAM roles are configured with a trust policy that allows the sts:AssumeRoleWithSAML action, targeted to the specific SAML provider ARN.
This grants permission to the federated users to assume the specific IAM role.
3
Configure the IdP claims mapping.
The IdP sends the mandatory AWS-specific SAML attributes (Role and RoleSessionName) in its SAML assertions.
AWS relies on these attributes to map the incoming user to the correct IAM role and SAML provider in the target account.

Anahtar Kavram

Direct SAML 2.0 federation configuration requires both trust registration in the target AWS account (using the sts:AssumeRoleWithSAML action in the role trust policy) and correct mapping of SAML attributes (Role and RoleSessionName) within the external Identity Provider.
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru