A biotechnology firm manages its workloads across multiple AWS accounts within an organization in AWS Organizations. The firm wants to implement a federated single sign-on (SSO) solution using their on-premises SAML 2.0-compliant Identity Provider (IdP) to allow researchers and administrators to log in to AWS member accounts. The identity solution must dynamically map corporate users to corresponding AWS IAM roles based on their corporate group membership (e.g., ResearchDataAnalyst, ComplianceAuditor).
The solutions architect must design a secure, scalable federation flow while adhering to the principle of least privilege. Additionally, the security team wants to enforce service-level guardrails across the entire organization using Service Control Policies (SCPs).
Which of the following configurations must be implemented to establish this federation and policy framework? (Select THREE.)
- Create a SAML Identity Provider entity in each member account that references the corporate IdP's metadata XML, and define IAM roles with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML provider principal.Cevap
- Configure the corporate IdP to release SAML assertions containing the https://aws.amazon.com/SAML/Attributes/Role attribute, which lists comma-separated pairs of the target IAM role ARN and the SAML provider ARN for the corresponding member account.Cevap
- Apply Service Control Policies (SCPs) at the Organizational Unit (OU) level to define the maximum permitted permissions for the federated roles, while attaching local IAM policies to the federated roles in each member account to explicitly grant the required AWS service permissions.Cevap
- DCreate IAM roles in each member account with a trust policy that permits the sts:AssumeRole action for the SAML provider principal, and configure the corporate IdP to pass the AWS role session name as a SAML attribute.
- EDefine the permissions for each user group directly within Service Control Policies (SCPs) applied to the target OUs, and configure the federated IAM roles with wildcard (*) administrator permissions, relying on the SCPs to grant the actual access.
- FRegister the corporate IdP as an OIDC Identity Provider in the management account, and use the sts:AssumeRoleWithWebIdentity action in the member account trust policies to enable cross-account federation for SAML users.