Examkin

Question

Difficulty: Very hardIdentity Federation and Directory Services

A multinational financial firm manages its cloud infrastructure using a multi-account AWS Organizations environment. All corporate user identities and security groups are maintained in an on-premises Microsoft Active Directory. The firm's compliance policy strictly prohibits the storage or replication of any user credentials or identity database records in the public cloud. The firm wants to enable federated single sign-on (SSO) for its employees to access the AWS Management Console and AWS CLI across all member accounts. The network architecture includes a dedicated AWS Direct Connect connection between the on-premises data center and a shared services VPC. The solution must minimize ongoing operational overhead and infrastructure costs. Which configuration should a solutions architect recommend to satisfy these requirements?

  1. Configure an AD Connector in the shared services VPC linked to the on-premises Active Directory. Enable AWS IAM Identity Center in the AWS Organizations management account, configure it to use the AD Connector as its directory source, and assign permission sets to on-premises Active Directory groups.Answer
  2. B
    Provision individual IAM users in each AWS member account corresponding to each Active Directory user. Configure an on-premises synchronization script that uses the Active Directory LDAP interface to manage IAM access keys and credentials.
  3. C
    Configure federated access using the AWS Organizations management account root user credentials to establish a SAML trust directly with the on-premises Active Directory, allowing federated users to perform administrative tasks.
  4. D
    Deploy an AD Connector in the shared services VPC. Store the Active Directory administrator service account credentials as plaintext parameters in Systems Manager Parameter Store to automate the connection to the on-premises Active Directory.

Answer

Configure an AD Connector in the shared services VPC linked to the on-premises Active Directory. Enable AWS IAM Identity Center in the AWS Organizations management account, configure it to use the AD Connector as its directory source, and assign permission sets to on-premises Active Directory groups.
The correct solution uses an AD Connector, which acts as a directory gateway to redirect directory requests to the on-premises Active Directory without caching or replicating any identity database records or user credentials in the public cloud. This directly satisfies the compliance requirement. By integrating AD Connector with AWS IAM Identity Center, the firm can centrally manage single sign-on access to the AWS Management Console and CLI across all accounts in AWS Organizations. Group-based access mapping ensures that permissions are assigned to existing Active Directory groups, minimizing operational overhead.

Step-by-Step Solution

1
Analyze compliance and data replication requirements.
Identified that identity data or credentials must not be replicated to the cloud, ruling out solutions that copy AD user accounts or store passwords in AWS.
Compliance policy strictly prohibits public cloud storage of user credentials or database records.
2
Select the appropriate directory integration service.
Choose AD Connector over AWS Managed Microsoft AD because AD Connector functions as a gateway proxy, redirecting authentication requests to the on-premises AD without data replication.
AD Connector avoids cloud identity storage and reduces costs compared to deploying managed domain controllers in AWS.
3
Configure the centralized authentication access mechanism.
Enable AWS IAM Identity Center in the AWS Organizations management account and associate it with the AD Connector.
Provides central management of access to console and CLI across multiple accounts, reducing operational overhead.
4
Map permissions to existing AD structures.
Assign AWS permission sets to existing on-premises Active Directory groups.
Allows group-based access control managed from the on-premises directory without manual mapping per user in AWS.

Key Concept

AWS IAM Identity Center integration with Active Directory using AD Connector to enable federated access without cloud-side credential replication.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic