Examkin

Question

Difficulty: EasyIdentity Federation and Directory Services

A university needs to provide its staff members with access to the AWS Management Console. The staff identities are stored in an external SAML 2.0-compliant identity provider. The security team wants to ensure that no long-term AWS credentials are created for these users, and access is managed centrally. Which AWS service is the recommended solution to meet this requirement?

  1. A
    AWS Identity and Access Management (IAM) users created for each staff member
  2. B
    AWS Directory Service for Microsoft Active Directory
  3. AWS IAM Identity CenterAnswer
  4. D
    The AWS account root user credentials shared among the staff

Answer

AWS IAM Identity Center
AWS IAM Identity Center allows organizations to configure single sign-on access to the AWS Management Console by federating with external SAML 2.0 identity providers. It dynamically provides short-term credentials, removing the need for long-term IAM credentials and reducing management overhead.

Step-by-Step Solution

1
Identify the requirement for federated access using an external SAML 2.0-compliant identity provider.
The solution must authenticate external identities without duplicating them locally.
This rules out solutions that require local directory hosting or manually creating local credentials.
2
Identify the constraint regarding credentials and management overhead.
Long-term credentials must not be generated, and management should be centralized.
This rules out individual IAM users and sharing the root account credentials.
3
Select the modern AWS service designed for central single sign-on and integration with external identity providers.
AWS IAM Identity Center enables connection with external SAML 2.0 providers and provides short-term credentials dynamically.
This matches all security and operational requirements.

Key Concept

AWS IAM Identity Center provides federated single sign-on access to the AWS Management Console from external SAML 2.0 identity providers without the use of long-term credentials.
Estimated Time:1m 0s
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic