Authentication and federation: CLF-C02 study notes and practice questions
What to know about Authentication and federation for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 2 free questions to test it. Part of the CLF-C02 study guide.
Identity questions ask how people prove who they are (authentication) and how they get into AWS accounts or applications.
The services
Need
Service
Employees sign in once and reach many AWS accounts and business apps
AWS IAM Identity Center (the successor to AWS Single Sign-On)
Use the existing corporate directory (such as Microsoft Active Directory or Okta)
Federation through IAM Identity Center or SAML 2.0
A managed Microsoft Active Directory in AWS
AWS Directory Service
Customers sign up and sign in to your web or mobile app
Amazon Cognito
Key facts
IAM Identity Center is the recommended way to manage workforce access to multiple accounts in AWS Organizations. Permission sets define job-based permissions once and assign them to users or groups in the accounts they need.
Federation means users sign in with an identity provider they already use, and AWS trusts that provider. No separate IAM users are needed.
Temporary credentials from federation and roles expire automatically, which is safer than long-term keys.
Multi-factor authentication (MFA) adds something you have (a security key or app) to something you know (a password).
Authentication vs authorization: authentication proves who you are; authorization decides what you can do (IAM policies).
Common traps
Cognito for employees. Cognito is for your application’s customers; workforce access uses IAM Identity Center.
Creating IAM users in every account for each employee. Use IAM Identity Center with permission sets.
Mixing up authentication and authorization. MFA is authentication; policies are authorization.
Directory Service vs IAM Identity Center. Directory Service runs a Microsoft Active Directory in AWS; IAM Identity Center is how users sign in to AWS accounts, and it can use that directory as its source of users.
B. Right: Correct. A virtual authenticator app emulates a physical MFA device. AWS lists it among the supported MFA types for the root user.
C. Wrong: SMS is not one of the MFA types AWS lists for the root user, so this device cannot be registered for root.
D. Wrong: A security question is something the user knows. It is not a second factor, and it is not an MFA type AWS supports for the root user.
E. Wrong: A password is a single factor, and a stronger password does not add MFA. AWS requires a separate MFA device for the root user.
Explanation
AWS supports three MFA types for the root user: FIDO certified hardware security keys, hardware TOTP tokens, and virtual authenticator apps. The root user can have up to eight MFA devices, and AWS recommends registering more than one. SMS, security questions and passwords are not among the MFA types AWS supports for the root user.
A company runs 40 AWS accounts in AWS Organizations and uses IAM Identity Center for workforce sign-in.
Its data analysts need the same permissions in 12 of those accounts.
The security team wants one definition that it can change once and apply to all 12 accounts.
Which feature should it use?
Choose one answer.
AA. IAM permissions boundaries attached to each analyst's role in every one of the 12 accounts
BB. A permission set in IAM Identity Center, assigned to the analysts' group in 12 accounts
CC. Service control policies (SCPs) attached to the 12 accounts that allow the analysts' actions
DD. An IAM group in each of the 12 accounts, with the same managed policy copied into each one
Show the answer and explanation
Answer: B
A. Wrong: A permissions boundary limits the maximum permissions a role can get, and it grants nothing itself. Attaching one per account would still mean managing each account separately.
C. Wrong: SCPs set the maximum permissions that accounts can use. They never grant permissions by themselves, so the analysts would still have no access.
D. Wrong: Copying one policy into 12 accounts creates 12 copies to keep in step. Any change means editing every account by hand, which the security team wants to avoid.
Explanation
Permission sets let administrators define job-function permissions once in IAM Identity Center and assign them to users or groups in the accounts they need. IAM Identity Center then creates the matching roles in each account. Permissions boundaries and SCPs limit permissions and do not grant access, and separate IAM groups mean maintaining copies in every account.
Want more on Authentication and federation? The 5 full-length practice sets have 10 more Authentication and federation questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →