DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS Security Token Service (STS) to generate temporary credentials for the users.

  Why it's wrong here

  AWS Security Token Service (STS) is a web service that enables you to request temporary, limited-privilege credentials for AWS users or for users that you authenticate (federated users). While STS is indeed used to generate the temporary credentials that federated users receive, it is not the mechanism for integrating a SAML Identity Provider (IdP) with AWS. The IdP integration itself is managed through IAM Identity Providers, which then allow users to assume an IAM role, and STS subsequently issues the temporary credentials for that assumed role.

• ✓

  Create an IAM identity provider for the SAML IdP and set up a role with a trust policy that allows federated users to assume it.

  Why this is correct

  This is the correct and standard approach for integrating a SAML-based Identity Provider with AWS. First, an IAM identity provider is created in AWS to register the SAML IdP's metadata document, establishing trust. Subsequently, an IAM role is configured with a trust policy that explicitly permits federated users from that specific SAML IdP to assume it, often based on SAML attributes. This role then defines the specific AWS permissions the federated users will inherit upon successful authentication and assumption.

• ✗

  Store the SAML metadata document in AWS Certificate Manager.

  Why it's wrong here

  AWS Certificate Manager (ACM) is specifically designed for provisioning, managing, and deploying SSL/TLS certificates for use with AWS services like Elastic Load Balancing, Amazon CloudFront, and API Gateway. It securely stores and renews these certificates. ACM does not provide functionality for storing or managing SAML identity provider metadata documents, which contain configuration information such as endpoints, public keys, and issuer details necessary for establishing trust with a SAML IdP. SAML metadata is uploaded directly to IAM when creating an IAM identity provider.

• ✗

  Use Amazon Cognito user pools with a SAML identity provider.

  Why it's wrong here

  Amazon Cognito User Pools are primarily used for managing user directories and handling user authentication for web and mobile applications, supporting social identity providers (like Google, Facebook) and OpenID Connect (OIDC) IdPs. However, User Pools do not directly support SAML federation for authenticating users. For SAML federation to grant access to AWS resources, Amazon Cognito Identity Pools are utilized. Identity Pools exchange credentials from an authenticated identity (which could be a User Pool or a SAML IdP) for temporary AWS credentials, enabling access to AWS services.

Go deeper

Related to this question