AWS Certified Solutions Architect Professional SAP-C02 Practice Question
A large enterprise uses Microsoft Entra ID as its corporate identity provider (IdP). The company operates a multi-account AWS environment under AWS Organizations and must give developers and data scientists access to specific roles in multiple AWS accounts. Security requirements include:
Manage user identities and group memberships only in Entra ID.
Implement attribute-based access control (ABAC) in AWS by tagging the federated session with the user's attributes.
Enforce least privilege, scale to hundreds of accounts, and avoid creating individual IAM users.
Which approach best meets these requirements?
Deploy AWS Directory Service AD Connector in a shared VPC, establish a trust with Entra ID, and have IAM roles in target accounts trust the directory for access.
In each AWS account, create one IAM role for every Entra ID group that needs access and map the groups to those roles through separate SAML configurations.
Automate the deployment of an identical SAML 2.0 identity provider (using Entra ID metadata) in every AWS account-e.g., with AWS CloudFormation StackSets. Configure Entra ID to pass user attributes as SAML assertions mapped to PrincipalTag session tags. In each account, create a single generic IAM role that trusts its local SAML provider and uses aws:PrincipalTag conditions in its policy to implement ABAC.
Create an OpenID Connect (OIDC) federation between Entra ID and a central AWS account and instruct users to call sts:AssumeRole with their OIDC tokens to access the required AWS roles.
The scalable pattern is to federate with SAML and pass Entra ID attributes as session tags, then use those tags in IAM policies. Because an IAM role can trust only a SAML provider that exists in the same AWS account, you automate the creation of an identical SAML identity-provider resource in every member account-commonly with AWS CloudFormation StackSets or delegated admin tooling. Entra ID is configured to emit user attributes (for example, group or department) as SAML attributes using the PrincipalTag prefix so STS converts them to session tags. Each account needs only one generic IAM role that trusts its local SAML provider. The role's permissions policy references the tags with aws:PrincipalTag condition keys, so access automatically adjusts when user attributes change. No per-user IAM objects are required, and policy updates are unnecessary when teams or resources grow.
Creating a separate IAM role for every Entra ID group in every account leads to role sprawl and is RBAC, not ABAC.
AD Connector integrates with on-premises Active Directory, not with cloud-only Entra ID, and does not support SAML attribute pass-through.
OIDC federation would require the sts:AssumeRoleWithWebIdentity API, not sts:AssumeRole, and still lacks the rich SAML session-tagging features needed here.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is SAML 2.0 and why is it important for identity federation?
Open an interactive chat with Bash
What are PrincipalTags, and how are they used in ABAC policies?
Open an interactive chat with Bash
What is AWS CloudFormation StackSets, and why is it used here?
Open an interactive chat with Bash
AWS Certified Solutions Architect Professional SAP-C02
Design Solutions for Organizational Complexity
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access