Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A media company is setting up a multi-account AWS environment under AWS Organizations. The administrator has configured a corporate Identity Provider (IdP) to enable single sign-on into a member account using SAML 2.0. A SAML provider has been created in the member account. An IAM role has been created for the federated users, but during testing, users receive an Access Denied error when attempting to federate from the IdP portal. The administrator reviews the IAM role's trust policy and finds the following policy document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:saml-provider/CorporateIDP"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
}
]
}

Which of the following modifications to the trust policy is required to resolve this issue?

  1. Change the Action from sts:AssumeRole to sts:AssumeRoleWithSAML.Cevap
  2. B
    Add sts:AssumeRoleWithSAML to a Service Control Policy (SCP) attached to the Organizational Unit (OU) containing the member account.
  3. C
    Change the Action from sts:AssumeRole to sts:AssumeRoleWithWebIdentity and configure an OIDC identity provider in the member account.
  4. D
    Change the Federated Principal from the SAML provider ARN to the ARN of the AWS Organization's management account.

Cevap

Change the Action from sts:AssumeRole to sts:AssumeRoleWithSAML.
The correct answer states that the trust policy action must be changed to 'sts:AssumeRoleWithSAML'. This is because SAML 2.0 federated access relies on the AWS Security Token Service (STS) validating the SAML assertion sent by the Identity Provider (IdP) and calling the AssumeRoleWithSAML API. Without this action specified in the trust policy, STS will refuse the request and return an Access Denied error.

Adım Adım Çözüm

1
Analyze the IAM role trust policy in the member account.
The current trust policy lists 'sts:AssumeRole' as the Action allowed for the federated SAML provider principal.
To determine why the external SAML identity provider cannot assume the target IAM role.
2
Identify the correct AWS Security Token Service (STS) action required for SAML 2.0 federation.
AWS STS requires 'sts:AssumeRoleWithSAML' to exchange a SAML assertion for temporary credentials.
The default 'sts:AssumeRole' action only supports cross-account or local IAM entity role assumption, not SAML federation.
3
Modify the Action element in the trust policy statement to allow the correct STS action.
Changing the Action value to 'sts:AssumeRoleWithSAML' allows AWS STS to process incoming SAML assertions successfully.
This establishes the necessary trust path between the external IdP and the target IAM role.

Anahtar Kavram

SAML 2.0 Trust Policy Configuration
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru