Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A technology company has configured a centralized Active Directory Federation Services (AD FS) portal to authenticate internal engineers. The portal is integrated with multiple AWS target accounts in an AWS Organization using SAML 2.0. However, during the initial deployment, engineers receive authentication failures when attempting to log in to target AWS accounts from the AD FS landing page. Which configuration must be applied to the IAM roles in the target AWS accounts to successfully establish federation with the corporate Identity Provider (IdP)?

  1. The IAM role trust policy in each target account must specify the ARN of the SAML identity provider as the Principal, declare the 'sts:AssumeRoleWithSAML' action, and include a condition that evaluates the 'SAML:aud' attribute to verify it matches the standard AWS SAML endpoint.Cevap
  2. B
    The IAM role trust policy in each target account must specify the ARN of the SAML identity provider as the Principal, declare the 'sts:AssumeRole' action, and trust the root principal of the target account as a secondary trust relationship.
  3. C
    The IAM role trust policy in each target account must specify the ARN of the SAML identity provider as the Principal, declare the 'sts:AssumeRoleWithWebIdentity' action, and evaluate the OpenID Connect audience attribute in the condition block.
  4. D
    A Service Control Policy (SCP) must be attached to the root of the AWS Organization that allows the 'sts:AssumeRole' action for the corporate identity provider, which automatically enables trust propagation across all member accounts without modifying individual role trust policies.

Cevap

The trust policy of the target IAM roles must specify the SAML provider ARN as the Principal, use the 'sts:AssumeRoleWithSAML' action, and evaluate the 'SAML:aud' condition attribute.
For SAML 2.0-based federation, the target IAM role's trust policy must trust the SAML provider ARN as the principal and allow the 'sts:AssumeRoleWithSAML' action. Additionally, validating the 'SAML:aud' attribute inside the condition block ensures that the SAML token was generated specifically for the AWS SAML sign-in endpoint, preventing unauthorized reuse.

Adım Adım Çözüm

1
Identify the federation protocol in use.
The target system uses SAML 2.0 via Active Directory Federation Services (AD FS).
The federation protocol dictates which Security Token Service (STS) action and principal type must be used in the IAM trust relationship.
2
Determine the correct STS action for SAML 2.0 integration.
The correct action is 'sts:AssumeRoleWithSAML'.
Only the AssumeRoleWithSAML action is capable of validating and exchanging SAML assertions for temporary security credentials.
3
Configure the Principal and Condition sections of the role trust policy.
Set the Principal to the ARN of the SAML provider in the target account, and set the condition key 'SAML:aud' to 'https://signin.aws.amazon.com/saml'.
This establishes a cryptographic trust relationship with the SAML provider object and validates that the audience of the SAML assertion is indeed the AWS login service.

Anahtar Kavram

SAML 2.0 Federation Trust Policies
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru