Which combination of steps should the security engineer take to accomplish this?
(Choose two.)
Download a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
Download a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.
During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity. Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
Download a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.
Explanations:
Creating a new IAM identity provider entity is unnecessary if only the certificate has changed; simply updating the existing entity with the new metadata is sufficient.
Adding a secondary certificate before expiration allows seamless certificate rotation, which helps avoid disruptions during future rotations. This setup supports automated or manual certificate management without downtime.
Updating the existing IAM identity provider entity with the new SAML metadata file immediately resolves the issue caused by the certificate rotation, allowing users to authenticate successfully.
Creating a new IAM identity provider entity with each rotation is unnecessary and can lead to complexity. Updating the existing entity and managing certificates within it is more efficient.
Updating the configuration to pass a new IAM entity name in the SAML assertion complicates the setup and isn’t necessary. Simply updating the existing IAM identity provider with the new metadata file is sufficient.
I conclude that the answer is:
During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.