Examkin

Soru

Zorluk: OrtaMulti-Account Identity and Access Management Federation

A global company is setting up federated access to multiple member accounts in an AWS Organization using an external SAML 2.0 Identity Provider (IdP) and AWS IAM Identity Center (AWS Single Sign-On). The solutions architect must automate user provisioning from the external IdP to AWS IAM Identity Center and configure attribute-based access control (ABAC) using the department user attribute. Which TWO configurations must the solutions architect implement to meet these requirements? (Select TWO.)

  1. Enable automatic provisioning in AWS IAM Identity Center and configure SCIM synchronization from the external Identity Provider to synchronize user identities and attributes.Cevap
  2. Configure the identity source in AWS IAM Identity Center to use the external SAML IdP, and configure permission sets to utilize the aws:PrincipalTag/department key in the IAM policy condition elements.Cevap
  3. C
    Create a Service Control Policy (SCP) at the root of the organization that defines the mapping between SAML attributes and AWS resource tags to automatically grant permissions across all accounts.
  4. D
    Manually create an IAM role in each member account with a trust policy that permits the sts:AssumeRole action with the SAML IdP as the principal.
  5. E
    Configure an IAM OpenID Connect (OIDC) identity provider in the organization management account and use the sts:AssumeRoleWithWebIdentity action in the trust policies of the roles in the member accounts.

Cevap

Configure automatic provisioning via SCIM from the external Identity Provider to AWS IAM Identity Center, and configure permission sets in AWS IAM Identity Center to use the department attribute passed in the principal tag (aws:PrincipalTag/department) for attribute-based access control.
The correct solution involves configuring SAML federation in AWS IAM Identity Center and setting up SCIM (System for Cross-domain Identity Management) synchronization from the external IdP to automate user provisioning. Once user attributes like department are synchronized, they can be utilized as principal tags (aws:PrincipalTag/department) in the IAM policy conditions of IAM Identity Center permission sets to enforce attribute-based access control (ABAC).

Adım Adım Çözüm

1
Set up SAML 2.0 federation and user provisioning in AWS IAM Identity Center.
AWS IAM Identity Center is configured to use the external SAML IdP as its identity source, and System for Cross-domain Identity Management (SCIM) is enabled to synchronize users, groups, and attributes automatically.
SCIM is the industry standard for automating user provisioning and metadata synchronization (such as user attributes) from external directory sources to AWS IAM Identity Center.
2
Enable Attribute-Based Access Control (ABAC) in AWS IAM Identity Center.
The department attribute synced from the IdP is mapped as a principal tag for access control, making it available as aws:PrincipalTag/department during authorization.
AWS IAM Identity Center supports using attributes passed from the identity provider as principal tags in IAM policies to implement dynamic access control.
3
Configure permission sets in AWS IAM Identity Center with attribute-based conditions.
Permission sets are created with IAM policy conditions that compare the principal's department tag to resource tags (e.g., aws:ResourceTag/department).
This allows a single permission set to dynamically grant access to resources matching the user's department without creating separate permission sets or roles for each department.

Anahtar Kavram

AWS IAM Identity Center supports SAML 2.0 federation and automatic user provisioning via SCIM. By enabling the attributes for access control feature, user attributes synced via SCIM are passed as session tags (aws:PrincipalTag) in AWS security tokens, enabling dynamic attribute-based access control (ABAC) across member accounts.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Multi-Account Identity and Access Management Federation

Bu konudan daha fazla soru