A company is migrating its operations to AWS and wants to grant its employees access to the AWS Management Console. The employees' identities are currently managed in an on-premises Microsoft Active Directory. The company's security policy requires that employees sign in using their existing corporate credentials and that administrative overhead related to credential management in AWS be minimized. Which combination of actions should a solutions architect recommend to meet these requirements? (Select two.)
- Enable AWS IAM Identity Center and configure it to use the corporate Active Directory as its identity source.Answer
- Create permission sets in AWS IAM Identity Center and assign them to the corporate Active Directory groups.Answer
- CCreate individual IAM users in the AWS account for each employee and configure multi-factor authentication (MFA) for each user.
- DConfigure the AWS account root user to allow concurrent logins and share the root password with all administrative staff.
- ECreate a single shared IAM user named 'corporate-access' and distribute its password to all employees.
Answer
To meet the requirements, the solutions architect should configure AWS IAM Identity Center with the corporate Active Directory as the identity source, and then map AWS permission sets to the existing Active Directory groups.
Connecting AWS IAM Identity Center to the on-premises Active Directory establishes federation, which supports using existing corporate credentials. Mapping permission sets to corporate Active Directory groups ensures administrative overhead is kept to a minimum by leveraging existing group memberships for access control.
Step-by-Step Solution
Key Concept
Using AWS IAM Identity Center to federate on-premises Microsoft Active Directory identities for single sign-on (SSO) to AWS accounts, reducing overhead and maintaining centralized credential management.