Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A company has configured a multi-account environment using AWS Organizations. The IT security team is setting up federated access for external database administrators to access a target database administration account. The company uses an on-premises SAML 2.0-compliant Identity Provider (IdP). A solutions architect creates an IAM SAML provider entity named "CorporateIDP" in the database administration account and configures the IdP with the corresponding AWS metadata. The solutions architect now needs to configure the IAM role in the database administration account that the database administrators will assume after authenticating via the IdP. Which configuration must be applied to the IAM role's trust policy in the database administration account to allow these users to federate successfully?

  1. A
    Configure the trust policy with the principal set to the SAML provider ARN (arn:aws:iam::<AccountID>:saml-provider/CorporateIDP), the action set to sts:AssumeRole, and a condition verifying that the SAML:sub attribute matches the database administrators group.
  2. B
    Configure the trust policy with the principal set to the AWS Organizations management account root user, and rely on a Service Control Policy (SCP) applied to the Organizational Unit (OU) to delegate permissions using the sts:AssumeRoleWithSAML action.
  3. Configure the trust policy with the principal set to the SAML provider ARN (arn:aws:iam::<AccountID>:saml-provider/CorporateIDP), the action set to sts:AssumeRoleWithSAML, and a condition verifying that the SAML:aud attribute matches https://signin.aws.amazon.com/saml.Cevap
  4. D
    Configure the trust policy with the principal set to the corporate Identity Provider's public IP address range, and the action set to sts:AssumeRoleWithWebIdentity to allow direct federation from the enterprise network.

Cevap

Configure the trust policy with the principal set to the SAML provider ARN, the action set to sts:AssumeRoleWithSAML, and a condition verifying that the SAML:aud attribute matches the standard AWS SAML endpoint.
The correct configuration requires defining a trust relationship where the principal is the IAM SAML provider ARN representing the corporate IdP. The action must be sts:AssumeRoleWithSAML to authorize the SAML assertion payload, and the SAML:aud condition ensures that the target audience is the official AWS SAML endpoint.

Adım Adım Çözüm

1
Identify the SAML provider resource in the target AWS account.
The SAML provider resource ARN (arn:aws:iam::<AccountID>:saml-provider/CorporateIDP) represents the trust relationship configuration.
The IAM role trust policy must specify this provider ARN as the trusted principal for incoming authentication assertions.
2
Select the correct STS API action for SAML token exchange.
Use the sts:AssumeRoleWithSAML action in the trust policy.
This specific action is designed for SAML 2.0 identity providers to exchange external SAML assertions for temporary AWS credentials.
3
Configure the audience constraint in the trust policy conditions.
Set a condition for the SAML:aud context key to match https://signin.aws.amazon.com/saml.
Verifying the audience matches the AWS SAML console endpoint prevents potential replay attacks and ensures validity of the token exchange.

Anahtar Kavram

SAML 2.0 Federation Trust Configuration in Multi-Account Environments
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru