Examkin

Question

Difficulty: EasyIdentity Federation and Directory Services

A retail enterprise has recently adopted a multi-account AWS environment using AWS Organizations. The IT security team must enable corporate employees to log in to the AWS Management Console across multiple accounts using their existing Microsoft Active Directory credentials, without creating permanent IAM credentials for each user. Which AWS service should the solutions architect recommend to meet these requirements with the least operational overhead?

  1. AWS IAM Identity CenterAnswer
  2. B
    AWS Directory Service for Microsoft Active Directory configured to sync all directory passwords to individual IAM users
  3. C
    The AWS account root user credentials shared across administrators using Multi-Factor Authentication (MFA)
  4. D
    Manually created IAM users for each employee with assigned IAM policies matching their Active Directory roles

Answer

AWS IAM Identity Center
AWS IAM Identity Center is the recommended service for centrally managing SSO access to multiple AWS accounts. It connects directly with an external Microsoft Active Directory and eliminates the need to manage individual IAM users or permanent credentials.

Step-by-Step Solution

1
Identify the core requirement, which is to allow enterprise users to access multiple AWS accounts centrally using their existing Microsoft Active Directory credentials without creating individual IAM users.
Centralized federation is required.
This minimizes operational overhead and avoids managing long-term IAM credentials for every employee.
2
Evaluate the available AWS services that support integration with external identity providers (IdPs) like Microsoft Active Directory and multi-account setups in AWS Organizations.
AWS IAM Identity Center is the modern, recommended service for multi-account federation.
It natively integrates with AWS Organizations and external directories to enable single sign-on (SSO) with minimal configuration.

Key Concept

Centralized multi-account federation using AWS IAM Identity Center and external directory integration
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic