Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An enterprise wants to allow its employees to log in to the AWS Management Console using their existing corporate credentials managed by an on-premises identity provider. The security team mandates that employees must not have permanent AWS IAM user credentials. Which of the following IAM features or mechanisms should the enterprise use to implement this configuration?

  1. Federate identities using an IAM role that trusts the external corporate identity providerAnswer
  2. B
    Create individual IAM users for each employee and configure AWS to sync their passwords with the corporate network
  3. C
    Share the AWS account root user credentials securely using an enterprise password vault
  4. D
    Configure the on-premises identity provider as a managed service within the AWS Shared Responsibility Model

Answer

Federate identities using an IAM role that trusts the external corporate identity provider
Federating identities with an IAM role that trusts the external corporate identity provider allows employees to obtain temporary credentials to access the AWS Management Console. This avoids the administrative overhead and security risks associated with creating and managing permanent IAM users for each employee.

Step-by-Step Solution

1
Analyze the business and security requirements
The solution must integrate an on-premises identity provider with AWS to allow console access without creating permanent AWS IAM users.
This establishes the constraints: federation/temporary credentials must be used, and IAM users must be avoided.
2
Evaluate the IAM capabilities for external identity integration
AWS IAM supports identity federation using OpenID Connect (OIDC) or SAML 2.0. By establishing a trust relationship, external users are mapped to temporary security credentials via IAM roles.
This matches the requirement for no permanent credentials while enabling single sign-on.
3
Identify and eliminate incorrect options
Creating individual IAM users creates permanent credentials. Sharing root user credentials violates root security practices. Assuming AWS manages on-premises identity systems is a misunderstanding of the Shared Responsibility Model.
This leaves the role-based identity federation option as the only secure and compliant answer.

Key Concept

IAM Identity Federation and Temporary Access
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic