Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company wants to allow its corporate employees to log in to the AWS Management Console using their existing Active Directory credentials. The security team wants to avoid the administrative overhead of creating and managing individual IAM users for each employee. Which of the following is the AWS-recommended approach to grant this access?

  1. Configure identity federation to grant employees temporary security credentials by assuming an IAM role.Answer
  2. B
    Create a single shared IAM user with administrator privileges and distribute the password to all employees.
  3. C
    Share the AWS Account Root User credentials with the Active Directory administrator to set up the connection.
  4. D
    Request that AWS Support manage the synchronization and patching of the on-premises Active Directory domain controllers.

Answer

Configure identity federation to grant employees temporary security credentials by assuming an IAM role.
Identity federation enables external users to access AWS resources securely using their existing corporate credentials. Instead of creating individual IAM users, the identity provider authenticates the users, and AWS maps their identity to an IAM role. The role provides them with temporary security credentials to access the AWS Management Console.

Step-by-Step Solution

1
Identify the requirement for using existing Active Directory credentials without creating individual IAM users in the AWS account.
The requirement points to identity federation, which maps external identities to AWS resources.
Identity federation eliminates the administrative overhead of managing separate credentials in AWS.
2
Select the secure mechanism to delegate permissions to these federated identities.
IAM roles are used to delegate temporary security credentials to trusted external entities.
Using roles ensures that external users do not require permanent IAM user credentials to access AWS resources.

Key Concept

Identity federation and IAM roles for external user access
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic