A company uses a third-party identity provider (IdP) with SAML-based SSO for its AWS accounts. After the IdP renewed an expired signing certificate, users receive the following error when attempting to sign in: Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken). A security engineer must resolve the issue while minimizing operational overhead. Which solution meets these requirements?

The error "Response Signature Invalid" indicates that AWS is unable to validate the SAML assertion signed by the IdP. This typically happens when the IdP's signing certificate has changed, but AWS still has the old certificate information. The solution is to update the SAML identity provider (IdP) entity in AWS IAM with the new metadata from the third-party IdP. This metadata file contains the new public key required for AWS to verify the SAML assertions. Downloading the updated SAML metadata file and using the AWS CLI (or Console) to update the IAM IdP is the standard and most efficient way to resolve this. Uploading the private key is incorrect and a security risk, as private keys should never be shared or uploaded to AWS for this purpose. Signing the metadata file with a new public key is not how SAML IdP updates work; the IdP signs the assertions, and AWS validates them using the public key in the metadata. Configuring synchronous fetching of the public key is not a standard or supported feature for SAML IdPs in AWS IAM.