SOA-C02 Question 174
Select 3Your company has implemented an application that allows users to authenticate via a third-party identity provider (IdP) and access AWS resources. The application uses SAML 2.0 for federated authentication. As a SysOps Administrator, you are tasked with ensuring that the users assume an IAM role with the least privileges when accessing AWS resources. Which of the following actions should you take to configure this setup correctly?
- A
Create an IAM role with a trust relationship that allows the third-party IdP to assume the role.
- B
Create a SAML provider in AWS IAM and upload the metadata document from the third-party IdP.
- C
Attach an inline policy to the IAM role to define least-privilege permissions for accessing AWS resources.
- D
Enable multi-factor authentication (MFA) for the IAM role to enhance security.
- E
Update the AWS resource policy to allow access only from the federated users using the role.
Show answer and explanation
Correct answers: A, B, C
Explanation
To configure federated authentication using SAML, you need to create an IAM role with a trust relationship that allows the third-party IdP to assume it. Additionally, you must create a SAML provider in AWS IAM and upload the metadata document from the IdP. Attaching a least-privilege policy to the IAM role ensures that users have only the necessary permissions to access AWS resources. Enabling MFA or modifying resource policies is not required for this specific setup.
- A. Correct.
Correct. To allow the third-party IdP to authenticate users and assume the IAM role, you need to create a trust relationship in the IAM role that specifies the SAML provider as a trusted entity.
- B. Correct.
Correct. A SAML provider must be created in IAM, including uploading the metadata document from the IdP, to enable federated authentication using SAML.
- C. Correct.
Correct. To enforce least-privilege access, an inline or managed policy must be attached to the IAM role. This policy defines the permissions for accessing AWS resources.
- D. Incorrect.
Incorrect. While MFA enhances security, it is not a requirement for enabling federated authentication via SAML. Enabling MFA for IAM roles is uncommon and not directly relevant to this scenario.
- E. Incorrect.
Incorrect. Updating AWS resource policies is not necessary in this case because the IAM role's permissions already control access to the resources for the federated users.