An enterprise manages a multi-account AWS environment under AWS Organizations. The enterprise must configure direct identity federation with an external SAML 2.0 Identity Provider (IdP) to allow corporate directory users to access target IAM roles in member accounts. The security team mandates the following controls:
1. Users must only be allowed to assume the administrative roles if they successfully completed multi-factor authentication (MFA) at the IdP.
2. The administrative roles must only be accessible when the login request originates from the corporate network's public IP range ().
Which TWO configurations must the Solutions Architect implement to meet these requirements?
- Configure the trust policy of each target IAM role to allow the sts:AssumeRoleWithSAML action, and add a condition block that evaluates saml:MultifactorAuthPresent to true. Ensure the corporate SAML IdP is configured to send the https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent attribute.Cevap
- In the trust policy of each target IAM role, add a condition block that uses the IpAddress operator to restrict the sts:AssumeRoleWithSAML action to the corporate public IP range using the aws:SourceIp condition key.Cevap
- CIn the trust policy of each target IAM role, set the trust principal to the SAML provider ARN, set the action to sts:AssumeRole, and add a condition block that evaluates the aws:MultiFactorAuthPresent key to true.
- DCreate an organizational Service Control Policy (SCP) at the Root level that denies all actions if the aws:MultiFactorAuthPresent condition key is false. Attach this SCP to all member OUs to enforce MFA globally for federated access.
- EConfigure the SAML IdP to map the user's IP address to the aws:SourceIp SAML attribute. In the IAM role's permission policy, add a condition that restricts all AWS API operations using the aws:SourceIp key against the corporate IP range.
Cevap
The correct configurations are to configure the target IAM role trust policies to allow the sts:AssumeRoleWithSAML action with a condition checking that saml:MultifactorAuthPresent is true while sending the matching attribute from the IdP, and to restrict the trust policy's sts:AssumeRoleWithSAML action using aws:SourceIp in the condition block.
To enforce multi-factor authentication for SAML federated users, the external Identity Provider must assert that MFA occurred by sending the https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent attribute. AWS STS maps this to the saml:MultifactorAuthPresent context key, which can be evaluated inside the trust policy of the IAM role. Additionally, the trust policy controls who and from where the role can be assumed; evaluating the aws:SourceIp condition key against the corporate IP range directly during the sts:AssumeRoleWithSAML action ensures that unauthorized network locations are blocked before the role is assumed.
Adım Adım Çözüm
Anahtar Kavram
Multi-Account Identity and Access Management Federation