AWS Certified Solutions Architect – Professional — Question 324

A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal, access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment.
Which items should the solutions architect check to ensure identity federation is properly configured? (Choose three.)

Answer options

• A. The IAM user's permissions policy has allowed the use of SAML federation for that user.
• B. The IAM roles created for the federated users' or federated groups' trust policy have set the SAML provider as the principal.
• C. Test users are not in the AWSFederatedUsers group in the company's IdR.
• D. The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML provider, the ARN of the IAM role, and the SAML assertion from IdR.
• E. The on-premises IdP's DNS hostname is reachable from the AWS environment VPCs.
• F. The company's IdP defines SAML assertions that properly map users or groups in the company to IAM roles with appropriate permissions.

Correct answer: B, D, F

Explanation

For SAML 2.0 federation to succeed, the IAM role's trust policy must establish trust with the SAML provider as the principal (B). The client-side portal must also construct a valid AWS STS AssumeRoleWithSAML request containing the necessary ARNs and assertion (D), and the IdP must map the user attributes to the target IAM roles via SAML assertions (F). Direct VPC connectivity to the IdP is unnecessary since the authentication flow goes through the user's web browser, and individual IAM user policies are not evaluated for federated access.