An enterprise uses AWS Organizations with a delegated administrator account for AWS IAM Identity Center. The organization federates with an external SAML 2.0 Identity Provider (IdP) to manage employee access. The security team must enforce a central security control: users accessing any member accounts in the 'Production' Organizational Unit (OU) must have authenticated using Multi-Factor Authentication (MFA) at the IdP. The IdP includes a SAML attribute named MFA_Verified with a value of true for sessions where MFA was completed. The security team wants to enforce this policy centrally across the Production OU without modifying individual permission sets.
Which combination of steps should a solutions architect implement to meet these requirements?
- Enable Attributes for Access Control (ABAC) in AWS IAM Identity Center, and map the SAML attribute MFA_Verified to the IAM session tag MFA_Status. Apply a Service Control Policy (SCP) to the Production OU that denies all actions when the principal is an IAM Identity Center role under the path /aws-reserved/sso.amazonaws.com/ and the condition aws:PrincipalTag/MFA_Status is not equal to true.Cevap
- BConfigure a SAML 2.0 Identity Provider (IdP) in each member account in the Production OU. Update the trust policy of all IAM Identity Center provisioned roles to allow sts:AssumeRole from the corporate IdP, adding a condition that checks saml:MFA_Verified is equal to true.
- CApply a Service Control Policy (SCP) to the Production OU that explicitly allows access only to federated users presenting the SAML attribute MFA_Verified set to true, relying on the SCP to dynamically inject the SAML assertion attribute as a principal session tag in the member accounts.
- DConfigure custom trust policies on the IAM Identity Center permission sets in the delegated administrator account. In the trust policies, allow sts:AssumeRoleWithWebIdentity from the external SAML IdP, and add a condition restricting access based on the saml:MFA_Verified attribute.