An enterprise is strengthening its identity and access security for a multi-account environment. System administrators must federate from an on-premises identity provider (IdP) via SAML 2.0 to access a centralized administration role in AWS Account A. To perform their duties, administrators must also manage encrypted backup files stored in an Amazon S3 bucket in Account B. The security team mandates that:
1. Administrators can only federate and assume the role in Account A when requests originate from the corporate network IP range ().
2. The administration role must be allowed to access and decrypt the backups in Account B without exposing the backup data to external accounts.
Which combination of configuration steps meets these security requirements?
- Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRoleWithSAML`, and a condition restricting `aws:SourceIp` to . In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.Cevap
- BConfigure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRole`, and a condition restricting `aws:SourceIp` to . In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.
- CConfigure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRoleWithSAML`, and a condition restricting `aws:SourceIp` to . In Account B, encrypt the S3 bucket using the default AWS-managed KMS key for Amazon S3 (`aws/s3`), and attach an IAM policy to the role in Account A allowing KMS decrypt operations.
- DApply a Service Control Policy (SCP) at the Organization root that denies all access if `aws:SourceIp` is not , assuming this SCP will automatically grant the federated role in Account A the required trust permissions without configuring a role trust policy. In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.