Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A financial technology company is implementing a multi-account AWS environment using AWS Organizations. The security team wants to establish federated access for internal developers using their corporate Active Directory Federation Services (AD FS) identity provider via SAML 2.0. The developers must be able to directly authenticate and access the AWS Management Console in multiple member accounts with specific permissions. Which TWO configurations are required to establish this trust relationship and enable federated access?

  1. Create a SAML 2.0 identity provider in each AWS member account, and create federated IAM roles with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider principal.Cevap
  2. Configure the corporate AD FS to send SAML assertions that map LDAP attributes to the AWS-defined claims for the role and the role session name.Cevap
  3. C
    Create a federated IAM role in the member accounts with a trust policy that permits the sts:AssumeRoleWithWebIdentity action pointing to the AD FS metadata endpoint.
  4. D
    Apply a Service Control Policy (SCP) at the root level of the AWS Organization that allows the sts:AssumeRoleWithSAML action for the external identity provider.
  5. E
    Configure the SAML 2.0 identity provider solely in the AWS Organizations management account, and configure AD FS to assume roles in the member accounts using the sts:AssumeRole action.

Cevap

The configurations requiring a SAML 2.0 identity provider in each member account with the sts:AssumeRoleWithSAML action, and configuring AD FS to send the specific AWS-defined SAML claims are required.
The correct configurations involve setting up a SAML 2.0 identity provider in each target member account and creating IAM roles with trust policies that allow the sts:AssumeRoleWithSAML action. Furthermore, the external identity provider (AD FS) must be configured to pass the mandatory SAML claims containing the role mapping and session name so that AWS can authorize the federated session.

Adım Adım Çözüm

1
Identify the federation protocol and the required IAM actions.
The company uses AD FS (SAML 2.0), which requires the sts:AssumeRoleWithSAML action in the role trust policy.
Using the correct security token service action is mandatory for AWS to validate the SAML assertion.
2
Determine the account scope for identity provider configuration.
A SAML identity provider must be created in each target member account, rather than only in the management account, to allow direct console login.
Federating directly to member accounts requires local trust configuration unless utilizing IAM Identity Center.
3
Map identity claims from the Identity Provider to AWS attributes.
The AD FS server must send the Role and RoleSessionName attributes in the SAML assertion.
AWS relies on these attributes to map the authenticated federated user to the target IAM role.

Anahtar Kavram

Establishing trust and attribute mapping in direct multi-account SAML 2.0 federation.
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru