Examkin

Soru

Zorluk: KolayMulti-Account Identity and Access Management Federation

An administrator is establishing a single sign-on integration between a third-party Identity Provider (IdP) and AWS accounts. Which of the following configuration steps are required to allow external directory users to assume specific IAM roles directly? (Select TWO.)

  1. Create a SAML provider entity in IAM using the XML metadata document from the Identity Provider.Cevap
  2. Configure the IAM role's trust policy to trust the SAML provider entity and permit the sts:AssumeRoleWithSAML action.Cevap
  3. C
    Configure the IAM role's trust policy to trust the Identity Provider using sts:AssumeRole as the action.
  4. D
    Attach a Service Control Policy to the member accounts that explicitly grants permission for the external Identity Provider to assume roles.

Cevap

Create a SAML provider entity in IAM using the XML metadata document from the Identity Provider, and configure the IAM role's trust policy to trust the SAML provider entity and permit the sts:AssumeRoleWithSAML action.
To set up SAML 2.0 federation, you must first register the Identity Provider in IAM using its XML metadata document to allow AWS to verify assertions. Second, you must create a role whose trust policy specifically allows the sts:AssumeRoleWithSAML action for the SAML provider principal.

Adım Adım Çözüm

1
Register the external identity provider inside the AWS IAM system.
A SAML provider entity is created containing the metadata and signing keys of the Identity Provider.
AWS needs to verify the authenticity of the SAML assertions sent by the Identity Provider during login.
2
Create an IAM role and write its trust policy to trust the SAML provider.
The IAM role trust policy allows the action sts:AssumeRoleWithSAML when the principal is the SAML provider.
Federated users cannot assume a role unless the role explicitly permits the sts:AssumeRoleWithSAML action from that provider.

Anahtar Kavram

SAML 2.0 federation trust configuration in AWS IAM
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru