Examkin

Soru

Zorluk: Çok zorMulti-Account Identity and Access Management Federation

An enterprise manages its multi-account environment using AWS Organizations. Users authenticate using a corporate SAML 2.0 Identity Provider (IdP) federated with a central Identity AWS account. From the Identity account, administrators use cross-account IAM roles to access target member accounts. A team of engineers requires continuous access to database migration tools in a specific member account for up to 8 hours. The Solutions Architect configures the maximum session duration for the cross-account role in the member account to 12 hours. However, engineers find that their sessions consistently expire and terminate after exactly 1 hour. Which solution should the Solutions Architect implement to allow the engineers to work uninterrupted for the required 8 hours?

  1. Implement AWS IAM Identity Center integrated with the corporate IdP, create a permission set configured with an 8-hour session duration, and assign it to the engineers' group for the target member account.Cevap
  2. B
    Configure the corporate IdP to include the SAML attribute https://aws.amazon.com/SAML/Attributes/SessionDuration set to 28800 in the assertion, relying on this value to propagate through the cross-account role assumption to the member account.
  3. C
    Attach a Service Control Policy (SCP) to the member account's Organizational Unit (OU) that overrides the maximum session duration for the cross-account role, configuring the sts:DurationSeconds policy condition to allow up to 28800 seconds.
  4. D
    Update the developers' local shell scripts to pass the --duration-seconds 28800 parameter when invoking the aws sts assume-role command to assume the member account's role from the identity account.

Cevap

Implement AWS IAM Identity Center integrated with the corporate IdP, create a permission set configured with an 8-hour session duration, and assign it to the engineers' group for the target member account.
The correct answer is to implement AWS IAM Identity Center integrated with the corporate IdP, configure a permission set with an 8-hour session duration, and assign it to the target account. This works because AWS IAM Identity Center handles federation directly to target accounts and provisions local roles without relying on cross-account role chaining. Consequently, the session duration defined in the permission set (up to 12 hours) is fully honored.

Adım Adım Çözüm

1
Analyze the current multi-account federation pattern.
Identify that users federate into a central Identity account and then perform cross-account role assumption to access target member accounts.
This establishes that the flow relies on role chaining (assuming one role from another assumed-role session).
2
Evaluate the session duration limitations of the role-chaining pattern.
Confirm that when assuming a role from an assumed-role session (role chaining), AWS enforces a hard limit of 1 hour on the session duration.
This explains why the session expires after 1 hour despite the target role's Maximum Session Duration being configured to 12 hours.
3
Identify a solution that avoids role-chaining limitations.
Select AWS IAM Identity Center (successor to AWS Single Sign-On) integrated with the corporate IdP.
IAM Identity Center directly provisions roles in the member accounts and federates users into those accounts. Because it does not use role chaining, it honors the session duration configured in the permission set (up to 12 hours).

Anahtar Kavram

AWS STS Role Chaining Session Duration Limits and Multi-Account Federation Patterns
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru