Soru

An enterprise implements a multi-account strategy using AWS Organizations. Users authenticate via an external corporate Identity Provider (IdP) using SAML 2.0. A solutions architect configures direct SAML federation to each member account by creating an IAM SAML identity provider and a federated IAM role in each account. The security team requires that federated users must only be allowed to assume the role if the authentication request originates from the corporate network range of $203.0.113.0/24$, and once authenticated, they must be prevented from performing any actions if they leave the corporate network. The solutions architect implements a Service Control Policy (SCP) at the root level of the organization that denies all actions ($*$) if the request context does not originate from $203.0.113.0/24$. The security team discovers that federated users are still able to successfully perform the initial authentication and obtain active AWS session credentials from outside the corporate network, although they cannot run any subsequent commands after the role is assumed. Which of the following modifications should the solutions architect make to ensure the entire authentication flow and subsequent actions are restricted to the corporate network?