Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

An enterprise is strengthening its identity and access security for a multi-account environment. System administrators must federate from an on-premises identity provider (IdP) via SAML 2.0 to access a centralized administration role in AWS Account A. To perform their duties, administrators must also manage encrypted backup files stored in an Amazon S3 bucket in Account B. The security team mandates that:

1. Administrators can only federate and assume the role in Account A when requests originate from the corporate network IP range (203.0.113.0/24203.0.113.0/24).
2. The administration role must be allowed to access and decrypt the backups in Account B without exposing the backup data to external accounts.

Which combination of configuration steps meets these security requirements?

  1. Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRoleWithSAML`, and a condition restricting `aws:SourceIp` to 203.0.113.0/24203.0.113.0/24. In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.Cevap
  2. B
    Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRole`, and a condition restricting `aws:SourceIp` to 203.0.113.0/24203.0.113.0/24. In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.
  3. C
    Configure the IAM role's trust policy in Account A with the SAML provider as the principal, the action set to `sts:AssumeRoleWithSAML`, and a condition restricting `aws:SourceIp` to 203.0.113.0/24203.0.113.0/24. In Account B, encrypt the S3 bucket using the default AWS-managed KMS key for Amazon S3 (`aws/s3`), and attach an IAM policy to the role in Account A allowing KMS decrypt operations.
  4. D
    Apply a Service Control Policy (SCP) at the Organization root that denies all access if `aws:SourceIp` is not 203.0.113.0/24203.0.113.0/24, assuming this SCP will automatically grant the federated role in Account A the required trust permissions without configuring a role trust policy. In Account B, encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to grant the federated role in Account A permission to perform KMS decrypt operations.

Cevap

Configure the trust policy of the IAM role in Account A with the action set to `sts:AssumeRoleWithSAML` and a condition restricting `aws:SourceIp` to the corporate network range, and use a Customer Managed Key (CMK) in Account B with a key policy allowing the role cross-account access.
The correct solution configures the IAM role trust policy in Account A with the `sts:AssumeRoleWithSAML` action to support SAML 2.0 federation and includes a condition matching `aws:SourceIp` to restrict access to the corporate network range. For cross-account access to encrypted backups in Account B, a Customer Managed Key (CMK) must be used because its key policy can be updated to trust the role in Account A, whereas AWS-managed keys cannot be shared across accounts.

Adım Adım Çözüm

1
Establish secure SAML 2.0 federation with source IP constraints.
The IAM role trust policy in Account A must trust the SAML IdP as principal, allow `sts:AssumeRoleWithSAML`, and restrict access using a condition block for `aws:SourceIp` to 203.0.113.0/24203.0.113.0/24.
SAML federation requires the specific `sts:AssumeRoleWithSAML` action to process SAML assertions. Restricting `aws:SourceIp` at the trust policy level ensures federation is only permitted from the corporate network.
2
Configure cross-account KMS encryption for S3 bucket backups.
Encrypt the S3 bucket in Account B with a Customer Managed Key (CMK) and update its key policy to grant key usage permissions to the federated IAM role in Account A.
AWS-managed KMS keys do not support key policy modifications and cannot be accessed across different AWS accounts. Using a CMK allows the key policy to be customized for cross-account access.

Anahtar Kavram

Implementing cross-account KMS access and securing SAML federation with trust policy source IP conditions.
Bu soruyu puanla