Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

An enterprise is planning to grant its network engineering team access to manage resources in the AWS Cloud. The network engineers are currently managed in the company's on-premises Active Directory. The company's security policy requires that engineers authenticate using their existing corporate credentials and that no long-term AWS credentials, such as access keys, are created or stored. Which solution meets these requirements while following AWS security best practices?

  1. A
    Share the AWS account root user credentials with the network engineering team and enable Multi-Factor Authentication using a shared corporate hardware token.
  2. Configure identity federation using AWS IAM Identity Center integrated with the company's Active Directory, and assign permission sets to the engineering group.Answer
  3. C
    Create individual IAM users in the AWS account for each network engineer, generate long-term access keys, and configure active directory synchronization to update their IAM passwords weekly.
  4. D
    Store the corporate Active Directory administrator credentials as a plaintext parameter in Systems Manager Parameter Store, and write a script on a bastion host to dynamically provision IAM roles for engineers when they log in.

Answer

Configure identity federation using AWS IAM Identity Center integrated with the company's Active Directory, and assign permission sets to the engineering group.
The correct solution uses AWS IAM Identity Center to federate the on-premises Active Directory. This allows network engineers to sign in with their corporate credentials and access AWS resources using short-term, temporary credentials. This directly fulfills both requirements of using existing corporate credentials and avoiding long-term access keys.

Step-by-Step Solution

1
Identify the authentication and credential requirements.
The requirements specify using existing corporate credentials (on-premises Active Directory) and avoiding the creation or storage of long-term AWS credentials.
This sets the boundary that IAM users with access keys should be avoided, and federation is required.
2
Select the appropriate AWS service for identity federation.
AWS IAM Identity Center provides native integration with active directories to enable federated single sign-on using temporary security tokens.
IAM Identity Center centralizes access management and eliminates the need for long-term IAM credentials for enterprise directory users.
3
Map permissions to the federated identities.
Assign AWS permission sets to the Active Directory engineering group to grant administrative access.
Permission sets define the level of access users have to AWS accounts and resources based on their directory group membership.

Key Concept

Identity Federation and Single Sign-On (SSO) with IAM Identity Center
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic