Examkin

Soru

Zorluk: ZorMulti-Account Identity and Access Management Federation

An enterprise manages a multi-account AWS environment under AWS Organizations. The security team wants to establish federated access for its operations team using an external SAML 2.0 Identity Provider (IdP). The operations team must be able to log in and assume the OperationsAdmin role in several member accounts under a specific Organizational Unit (OU). The architecture must prevent any other roles in these member accounts from being assumed via SAML federation, and it must ensure that only authorized SAML assertions can assume the role. Which TWO configurations must the solutions architect implement to meet these requirements?

  1. In each member account, create the OperationsAdmin IAM role with a trust policy that allows the sts:AssumeRoleWithSAML action for the SAML Identity Provider principal, and includes a condition verifying that the SAML:aud attribute is set to https://signin.aws.amazon.com/saml.Cevap
  2. Attach a Service Control Policy (SCP) to the OU containing the member accounts that denies sts:AssumeRoleWithSAML for all resources except for the Amazon Resource Name (ARN) of the OperationsAdmin role.Cevap
  3. C
    In each member account, create the OperationsAdmin IAM role with a trust policy that allows the sts:AssumeRole action for the SAML Identity Provider principal, and configure the IdP to pass the role ARN as a SAML attribute.
  4. D
    Attach a Service Control Policy (SCP) to the OU containing the member accounts that permits the sts:AssumeRoleWithSAML action exclusively for the OperationsAdmin role, which overrides the need for local trust policies in the member accounts.
  5. E
    Configure a central delegated administrator account in AWS IAM Identity Center and share the identity provider metadata using AWS Resource Access Manager (RAM) to all member accounts in the OU.

Cevap

To configure secure multi-account federation, the OperationsAdmin role must be created in each member account with a trust policy allowing sts:AssumeRoleWithSAML and validating the SAML:aud condition. Additionally, a Service Control Policy (SCP) must be attached to the OU containing the member accounts to deny sts:AssumeRoleWithSAML for all resources except the OperationsAdmin role.
Establishing federated access requires configuring a local trust policy on the target IAM role in each member account that trusts the SAML Identity Provider and allows the sts:AssumeRoleWithSAML action, verifying the SAML:aud condition to prevent unauthorized logins. To enforce a multi-account guardrail that restricts SAML federation exclusively to this role, a Service Control Policy (SCP) must be attached to the OU that denies the sts:AssumeRoleWithSAML action for all resources except the specific role ARN. This combination ensures secure identity federation and organizational compliance.

Adım Adım Çözüm

1
Determine the correct AWS Security Token Service (STS) action required for SAML 2.0 federation trust policies.
Identify that the trust policy of the IAM role must permit the sts:AssumeRoleWithSAML action and contain a condition checking that the SAML:aud attribute matches the AWS SAML endpoint (https://signin.aws.amazon.com/saml).
SAML federation authentication requests are processed via the AssumeRoleWithSAML API operation rather than standard cross-account AssumeRole API calls.
2
Formulate a policy to restrict SAML role assumption to only the OperationsAdmin role across the Organizational Unit (OU).
Create a Service Control Policy (SCP) that uses a Deny effect with a NotResource block pointing to the OperationsAdmin role's ARN, targeting the sts:AssumeRoleWithSAML action.
SCPs act as organizational guardrails. By applying a Deny statement on sts:AssumeRoleWithSAML for all resources except the specified role, the organization prevents the federation of any other role in those accounts.

Anahtar Kavram

Configuring SAML 2.0 federation using trust policies and enforcing multi-account access boundaries with Service Control Policies (SCPs).
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru