A company has a local SAML 2.0-compliant IdP that is used to authenticate users’ identities. The on-premises servers are being migrated to AWS, and you need to establish the trust relationship between AWS resources and the local IdP.
You have already created a SAML identity provider in AWS, and now you need to configure an IAM role to allow SAML-federated access to the AWS Management Console.
Which of the below trust policies is correct for the IAM role?

Answer options:

A.{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Resource": {"IDP": "arn:aws:iam::EXAMPLE-ACCOUNT-ID:saml-provider/ExampleOrgSSOProvider"},
"Action": "sts:*"
}
}]
}
B. {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Federated": "arn:aws:iam::EXAMPLE-ACCOUNT-ID:saml-provider/ExampleOrgSSOProvider"},
"Action": "sts:AssumeRoleWithSAML"
}
}]
}
C.{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Federated": "arn:aws:iam::EXAMPLE-ACCOUNT-ID:saml-provider/ExampleOrgSSOProvider"},
"Action": "sts:AssumeRoleWithWebIdentity"
}
}]
}
D.{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": "*",
"Resource": {"Federated": "arn:aws:iam::EXAMPLE-ACCOUNT-ID:saml-provider/ExampleOrgSSOProvider"},
"Action": "sts:AssumeRoleWithSAML"
}
}]
}

Answer: B
Option A is incorrect because trust policies in IAM roles should not have the Resource field. Trust policy is used to allow a Principal to assume the IAM role.
Option B is CORRECT because the trust policy allows the SAML identity provider to assume a role with a defined IAM access policy. The SAML provider is the one you created earlier in IAM.
Option C is incorrect because the allowed Action should be AssumeRoleWithSAML instead of AssumeRoleWithWebIdentity.
Option D is incorrect because ARN should be put inside the Principal field instead of the Resource field in the SAML provider trust policy.
An IAM role can be used to set up the SAML 2.0-compliant identity provider (IdP) and AWS to allow the federated users to access the AWS Management Console.
Reference:
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html#CreatingSAML-configuring-role.