Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A company is configuring federated single sign-on (SSO) access to multiple AWS member accounts in an AWS Organization using an on-premises Active Directory Federation Services (AD FS) identity provider. A solutions architect has created a SAML identity provider in each AWS member account. To allow authenticated enterprise users to assume specific IAM roles in the member accounts, which configuration is required in the trust policy of these IAM roles?

  1. A
    Configure the Principal element to reference the ARN of the SAML identity provider created in the member account, and set the Action element to sts:AssumeRole.
  2. B
    Configure the Principal element to reference the federated user's principal name, and set the Action element to sts:AssumeRoleWithWebIdentity.
  3. Configure the Principal element to reference the ARN of the SAML identity provider created in the member account, and set the Action element to sts:AssumeRoleWithSAML.Cevap
  4. D
    Configure the Principal element to reference the AWS Organization's management account root ARN and allow the sts:AssumeRole action, relying on a Service Control Policy (SCP) to map AD FS groups to the roles.

Cevap

Configure the Principal element to reference the ARN of the SAML identity provider created in the member account, and set the Action element to sts:AssumeRoleWithSAML.
The correct answer specifies configuring the Principal element to reference the ARN of the SAML identity provider and setting the Action element to sts:AssumeRoleWithSAML. To establish trust for federated users, the IAM role's trust policy must explicitly trust the local SAML provider created in the account and permit the sts:AssumeRoleWithSAML action.

Adım Adım Çözüm

1
Identify the federation protocol used by the corporate identity provider.
The corporate identity provider uses SAML 2.0.
Choosing the correct Security Token Service (STS) API action requires knowing the authentication protocol.
2
Identify the correct trust relationship principal for the IAM roles.
The local SAML identity provider ARN in the member account must be set as the Principal.
IAM roles must explicitly trust the local identity provider to accept assertions from it.
3
Select the correct STS action that enables the exchange of SAML assertions.
The action is sts:AssumeRoleWithSAML.
This specific action enables exchanging the SAML assertion for temporary AWS security credentials.

Anahtar Kavram

To implement SAML 2.0 federation, target IAM roles in member accounts must contain a trust policy that sets the SAML provider ARN as the Principal and permits the sts:AssumeRoleWithSAML action.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru