Soru

Zorluk: KolayMulti-Account Identity and Access Management Federation

An organization wants to configure federated single sign-on (SSO) to allow corporate users to access the AWS Management Console using their existing on-premises SAML 2.0 compliant Identity Provider (IdP). To establish this trust relationship, which of the following configuration steps must be performed within AWS Identity and Access Management (IAM)? (Select TWO.)

  1. Create an IAM SAML identity provider entity by uploading the SAML metadata document obtained from the on-premises IdP.Cevap
  2. Create an IAM role for SAML 2.0 federation with a trust policy that allows the sts:AssumeRoleWithSAML action and designates the SAML provider as the principal.Cevap
  3. C
    Create an IAM role with a trust policy that permits the sts:AssumeRole action and designates the external SAML provider as the principal.
  4. D
    Create a Service Control Policy (SCP) at the root level of the AWS Organization to grant console access to the external SAML provider.

Cevap

To configure SAML 2.0 single sign-on (SSO) in AWS, you must create a SAML identity provider in IAM using the IdP's metadata document, and create an IAM role for SAML 2.0 federation with a trust policy that permits the sts:AssumeRoleWithSAML action.
The correct options are creating an IAM SAML identity provider using the IdP metadata document and configuring an IAM role with a trust policy that permits the sts:AssumeRoleWithSAML action. Together, these configurations establish trust and allow federated users to gain temporary access to AWS resources using SAML assertions.

Adım Adım Çözüm

1
Upload the IdP metadata document to AWS IAM.
A SAML identity provider entity is created inside the AWS account, establishing trust.
AWS needs to know the signing certificates and endpoints of the external identity provider to validate incoming SAML assertions.
2
Create an IAM role for SAML 2.0 federation with the appropriate trust policy.
An IAM role is created with the trust policy action set to sts:AssumeRoleWithSAML and the Principal set to the ARN of the SAML provider.
This configuration allows users authenticated by the SAML IdP to assume the role and obtain temporary credentials to access AWS resources.

Anahtar Kavram

SAML 2.0 identity federation configuration in AWS IAM
Bu soruyu puanla