Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A software development company wants to allow its developers to access the AWS Management Console using their existing corporate Active Directory credentials. The security team needs to configure this access without creating individual IAM users for each developer. Which of the following approaches represents the AWS-recommended best practice to achieve this?

  1. Configure identity federation using AWS IAM Identity Center to map corporate Active Directory groups to IAM roles.Answer
  2. B
    Create a single shared IAM user with administrator permissions and distribute the credentials to all developers.
  3. C
    Configure the corporate Active Directory domain controllers to authenticate directly using the AWS account root user credentials.
  4. D
    Rely on AWS to automatically manage and synchronize corporate Active Directory user accounts as part of the AWS shared responsibility model.

Answer

Configuring identity federation using AWS IAM Identity Center to map corporate Active Directory groups to IAM roles is the correct approach.
Configuring identity federation using AWS IAM Identity Center allows the organization to leverage its existing corporate identity provider. By mapping Active Directory groups to IAM roles, developers can sign in with their corporate credentials and assume temporary security credentials, eliminating the need to create and maintain individual IAM users in AWS.

Step-by-Step Solution

1
Identify the requirement of using existing corporate credentials for AWS console access without creating local IAM users.
This points to a need for identity federation rather than standard IAM user creation.
Federation delegates authentication to an external identity provider.
2
Determine the appropriate AWS service for integration.
AWS IAM Identity Center is the recommended service for managing single sign-on access to AWS accounts and applications.
It simplifies multi-account access and integrates with external identity sources like Active Directory.
3
Map the corporate identities to AWS permissions.
Active Directory groups are mapped to specific IAM roles that define the permissions developers will assume upon login.
IAM roles provide temporary credentials, ensuring secure and automated access control.

Key Concept

Identity Federation and Role-Based Access Control
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic