A logistics company is designing a security architecture for its new multi-account AWS environment managed by AWS Organizations. The company manages all corporate identities in an on-premises Microsoft Active Directory. The security team wants to grant employees single sign-on (SSO) access to the AWS Management Console. The solution must authenticate users against the on-premises directory without replicating any Active Directory data to AWS, must avoid the creation of individual IAM users, and must minimize administrative effort. Which solution meets these requirements?
- Configure AWS IAM Identity Center and connect it to the on-premises directory by deploying an AD Connector.Answer
- BCreate individual IAM users in each AWS account corresponding to Active Directory identities, and use an automation script to synchronize passwords.
- CDeploy AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) and configure a synchronization agent to replicate Active Directory credentials to AWS.
- DSet up SAML 2.0 federation in each AWS account using the AWS account root user to import metadata and establish role-mapping policies.
Answer
Configure AWS IAM Identity Center and connect it to the on-premises directory by deploying an AD Connector.
Deploying an AD Connector as a proxy between AWS IAM Identity Center and the on-premises Microsoft Active Directory satisfies all security and operational requirements. AD Connector redirects authentication requests directly to the on-premises domain controllers, ensuring that directory data is never replicated to the cloud. AWS IAM Identity Center provides centralized single sign-on access control across all accounts within the AWS Organizations structure, eliminating the need to manage individual IAM users or credentials.
Step-by-Step Solution
Key Concept
Federating on-premises Active Directory to AWS Organizations using AD Connector and AWS IAM Identity Center to prevent data replication and minimize management overhead.
Estimated Time:1m 30s