A global manufacturing consortium uses AWS Organizations to manage workloads across dozens of AWS accounts. The consortium wants to enable single sign-on (SSO) for its vendor engineers who are managed in an external Active Directory Federation Services (AD FS) instance using SAML 2.0. The vendor engineers must be able to access target AWS resources in individual member accounts using the AWS Command Line Interface (AWS CLI) and the AWS Management Console. Which of the following actions must the Solutions Architect perform to implement this federated access model? (Select TWO.)
- In each target AWS account, create an IAM SAML identity provider and create an IAM role with a trust policy that grants the sts:AssumeRoleWithSAML action to the identity provider principal.Cevap
- Configure the AD FS identity provider to send SAML assertions that include the Role and RoleSessionName attributes mapped to the user's AD groups and session identifiers.Cevap
- CIn each target AWS account, create an IAM role with a trust policy that allows the sts:AssumeRoleWithWebIdentity action and designates the external AD FS provider as an OpenID Connect (OIDC) identity provider.
- DApply a Service Control Policy (SCP) to the organization's root that trusts the corporate AD FS endpoint, automatically permitting cross-account role assumption across all member accounts without local identity provider configurations.
Cevap
Creating an IAM SAML identity provider and role using the sts:AssumeRoleWithSAML action in each target account, and configuring the AD FS provider to send assertions containing the Role and RoleSessionName attributes.
To establish SAML 2.0-based federation, an IAM SAML identity provider must be created in each target AWS account. An IAM role is then configured in each account with a trust policy that explicitly allows the sts:AssumeRoleWithSAML action for that provider. Additionally, the external Identity Provider (such as AD FS) must be configured to pass the mandatory AWS SAML attributes: Role (which lists the ARNs of the role and the identity provider) and RoleSessionName (which specifies the session identifier). Together, these configurations enable federated users to authenticate and assume the correct roles in target accounts.
Adım Adım Çözüm
Anahtar Kavram
Establishing SAML 2.0 federation in a multi-account environment requires creating local IAM SAML identity providers, defining roles with trust policies using the sts:AssumeRoleWithSAML action, and configuring the external IdP to pass the required Role and RoleSessionName attributes in the SAML assertion.