A company is configuring single sign-on access for its database administrators to manage resources in a dedicated database member account under AWS Organizations. The database administrators authenticate using a third-party SAML 2.0 Identity Provider (IdP). A Solutions Architect needs to set up the trust relationship in the database member account to allow these users to assume an IAM role named 'DB-Admin-Role'. Which two actions must the Solutions Architect take to configure this federated trust?
- Create an IAM SAML identity provider in the database member account by uploading the XML metadata document from the third-party IdP.Cevap
- Configure the trust policy of the target IAM role to define the Principal as the ARN of the IAM SAML provider and set the Action to sts:AssumeRoleWithSAML.Cevap
- CConfigure the trust policy of the target IAM role to define the Principal as the external IdP's metadata URL and set the Action to sts:AssumeRole.
- DDefine the Principal in the IAM role's trust policy as the AWS Organizations management account root and delegate user assertion verification using a Service Control Policy (SCP).
- ECreate an IAM SAML identity provider in the AWS Organizations management account and share it with the database member account using AWS Resource Access Manager (RAM).
Cevap
Create an IAM SAML identity provider in the database member account using the XML metadata from the IdP, and configure the target IAM role's trust policy to define the SAML provider's ARN as the Principal with the action set to `sts:AssumeRoleWithSAML`.
To establish SAML federation within a member account, a Solutions Architect must first configure a local IAM SAML provider using the IdP metadata. Then, the trust policy of the destination IAM role must be updated to trust this provider's ARN and authorize the `sts:AssumeRoleWithSAML` action.
Adım Adım Çözüm
Anahtar Kavram
SAML 2.0 Federation Trust Configuration in Multi-Account Environments