An organization wants to configure federated single sign-on (SSO) to allow corporate users to access the AWS Management Console using their existing on-premises SAML 2.0 compliant Identity Provider (IdP). To establish this trust relationship, which of the following configuration steps must be performed within AWS Identity and Access Management (IAM)? (Select TWO.)
- Create an IAM SAML identity provider entity by uploading the SAML metadata document obtained from the on-premises IdP.Cevap
- Create an IAM role for SAML 2.0 federation with a trust policy that allows the sts:AssumeRoleWithSAML action and designates the SAML provider as the principal.Cevap
- CCreate an IAM role with a trust policy that permits the sts:AssumeRole action and designates the external SAML provider as the principal.
- DCreate a Service Control Policy (SCP) at the root level of the AWS Organization to grant console access to the external SAML provider.
Cevap
To configure SAML 2.0 single sign-on (SSO) in AWS, you must create a SAML identity provider in IAM using the IdP's metadata document, and create an IAM role for SAML 2.0 federation with a trust policy that permits the sts:AssumeRoleWithSAML action.
The correct options are creating an IAM SAML identity provider using the IdP metadata document and configuring an IAM role with a trust policy that permits the sts:AssumeRoleWithSAML action. Together, these configurations establish trust and allow federated users to gain temporary access to AWS resources using SAML assertions.
Adım Adım Çözüm
Anahtar Kavram
SAML 2.0 identity federation configuration in AWS IAM