Soru

Zorluk: Çok zorMulti-Account Identity and Access Management Federation

An enterprise manages a multi-account AWS environment under AWS Organizations. The enterprise must configure direct identity federation with an external SAML 2.0 Identity Provider (IdP) to allow corporate directory users to access target IAM roles in member accounts. The security team mandates the following controls:
1. Users must only be allowed to assume the administrative roles if they successfully completed multi-factor authentication (MFA) at the IdP.
2. The administrative roles must only be accessible when the login request originates from the corporate network's public IP range (203.0.113.0/24203.0.113.0/24).

Which TWO configurations must the Solutions Architect implement to meet these requirements?

  1. Configure the trust policy of each target IAM role to allow the sts:AssumeRoleWithSAML action, and add a condition block that evaluates saml:MultifactorAuthPresent to true. Ensure the corporate SAML IdP is configured to send the https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent attribute.Cevap
  2. In the trust policy of each target IAM role, add a condition block that uses the IpAddress operator to restrict the sts:AssumeRoleWithSAML action to the corporate public IP range using the aws:SourceIp condition key.Cevap
  3. C
    In the trust policy of each target IAM role, set the trust principal to the SAML provider ARN, set the action to sts:AssumeRole, and add a condition block that evaluates the aws:MultiFactorAuthPresent key to true.
  4. D
    Create an organizational Service Control Policy (SCP) at the Root level that denies all actions if the aws:MultiFactorAuthPresent condition key is false. Attach this SCP to all member OUs to enforce MFA globally for federated access.
  5. E
    Configure the SAML IdP to map the user's IP address to the aws:SourceIp SAML attribute. In the IAM role's permission policy, add a condition that restricts all AWS API operations using the aws:SourceIp key against the corporate IP range.

Cevap

The correct configurations are to configure the target IAM role trust policies to allow the sts:AssumeRoleWithSAML action with a condition checking that saml:MultifactorAuthPresent is true while sending the matching attribute from the IdP, and to restrict the trust policy's sts:AssumeRoleWithSAML action using aws:SourceIp in the condition block.
To enforce multi-factor authentication for SAML federated users, the external Identity Provider must assert that MFA occurred by sending the https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent attribute. AWS STS maps this to the saml:MultifactorAuthPresent context key, which can be evaluated inside the trust policy of the IAM role. Additionally, the trust policy controls who and from where the role can be assumed; evaluating the aws:SourceIp condition key against the corporate IP range directly during the sts:AssumeRoleWithSAML action ensures that unauthorized network locations are blocked before the role is assumed.

Adım Adım Çözüm

1
Configure the external SAML Identity Provider (IdP) to include the attribute https://aws.amazon.com/SAML/Attributes/MultifactorAuthPresent set to true in the SAML assertion when the user performs MFA.
The SAML assertion will convey the user's MFA status to AWS STS during the federation handshake.
AWS STS maps this specific SAML attribute to the saml:MultifactorAuthPresent context key, which is required for policy validation.
2
Modify the target IAM role trust policies to only allow the sts:AssumeRoleWithSAML action when the condition key saml:MultifactorAuthPresent is set to true.
Role assumption is restricted to federated sessions that have successfully completed IdP-managed MFA.
This establishes a secure trust boundary during the initial authentication handshake rather than after session creation.
3
Add a condition block to the target IAM role trust policies that restricts the sts:AssumeRoleWithSAML action using the aws:SourceIp condition key and the corporate public CIDR block.
The STS call will be rejected if the client's request originates from an IP address outside the corporate network.
Evaluating the source IP directly on the role trust policy prevents unauthorized external clients from completing the federation process.

Anahtar Kavram

Multi-Account Identity and Access Management Federation
Bu soruyu puanla