Examkin

Question

Difficulty: HardIdentity Federation and Directory Services

A multiplayer game studio is building a new development environment consisting of multiple AWS accounts managed under AWS Organizations. The studio's corporate identity provider (IdP) is PingFederate, which holds all employee credentials. The game developers need single sign-on (SSO) access to both the AWS Management Console and several external SaaS-based collaboration tools. The solution must support automatic user provisioning and ensure that access is dynamically updated when developers join or leave projects, without managing long-term credentials in individual AWS accounts. Which solution meets these requirements with the least operational complexity?

  1. A
    Configure PingFederate as a SAML 2.0 identity provider directly in each member AWS account. Create a script that automatically provisions IAM users with long-term credentials in each AWS account when a developer is added in PingFederate, and configure the same credentials for SaaS tool access.
  2. B
    Deploy an AD Connector in the management account to link PingFederate to AWS. Configure a script that creates individual IAM users with programmatic keys for each developer within the management account, and use cross-account IAM roles to delegate access to member accounts.
  3. Configure AWS IAM Identity Center, integrated with AWS Organizations, to use PingFederate as an external identity provider using SAML 2.0. Enable SCIM-based automatic provisioning from PingFederate to IAM Identity Center. Configure permission sets in IAM Identity Center for the AWS accounts and add custom SAML 2.0 applications for the SaaS collaboration tools.Answer
  4. D
    Configure PingFederate to federate directly with the AWS account root user of each member account using SAML 2.0. Use the root user credentials to establish API integrations with the SaaS collaboration tools to automate access management.

Answer

Configure AWS IAM Identity Center, integrated with AWS Organizations, to use PingFederate as an external identity provider using SAML 2.0. Enable SCIM-based automatic provisioning from PingFederate to IAM Identity Center. Configure permission sets in IAM Identity Center for the AWS accounts and add custom SAML 2.0 applications for the SaaS collaboration tools.
The correct solution leverages AWS IAM Identity Center integrated with AWS Organizations to centralize access control. By configuring PingFederate as an external SAML 2.0 identity provider and enabling SCIM-based automatic provisioning, the studio automates user lifecycle management and access dynamically. Furthermore, AWS IAM Identity Center supports custom SAML applications, allowing developers to authenticate into both AWS environments and SaaS collaboration tools from a single user portal without managing long-term credentials.

Step-by-Step Solution

1
Establish federation between the external identity provider (PingFederate) and AWS IAM Identity Center.
Trust is configured centrally, allowing users to authenticate with their existing PingFederate credentials.
Centralizing federation avoids the operational overhead of setting up SAML configurations individually in each AWS account.
2
Enable SCIM-based automatic provisioning between PingFederate and AWS IAM Identity Center.
User accounts and group memberships are automatically synchronized and updated when developers join or leave the studio.
SCIM removes the need for custom scripts or manual synchronization, satisfying the requirement to keep access dynamically updated with minimal overhead.
3
Create permission sets and assign them to users or groups for member accounts, and configure custom SAML 2.0 applications in IAM Identity Center for external SaaS tools.
Developers get single sign-on access to all assigned AWS accounts and SaaS tools through a single portal.
IAM Identity Center natively supports both multi-account AWS access and external SAML applications, eliminating individual account credential management.

Key Concept

Centralized Identity Federation and Directory Services with AWS IAM Identity Center and SCIM
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic