Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A digital marketing agency with 250 employees uses Google Workspace as its central identity provider. The agency has recently adopted a multi-account AWS environment managed under AWS Organizations to isolate client projects. The agency's solutions architect must implement a single sign-on (SSO) solution that allows developers to access their respective AWS accounts using their Google Workspace credentials. The solution must minimize operational complexity, avoid managing separate IAM users, and automatically synchronize user accounts when developers join or leave the agency.

Which solution should the solutions architect recommend to meet these requirements?

  1. A
    Deploy an AWS Directory Service AD Connector in a central VPC, configure it to connect to the Google Workspace directory via LDAP, and map directory groups to IAM roles in each individual AWS account.
  2. Enable and configure AWS IAM Identity Center, set Google Workspace as an external identity provider using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.Answer
  3. C
    Create individual IAM users for each developer in each of the client AWS accounts, generate long-term access keys, and configure a custom synchronization script using the Google Workspace Directory API.
  4. D
    Configure a SAML 2.0 identity provider in each client AWS account, map Google Workspace groups to IAM roles, and configure the AWS Organizations management account root user to authenticate federated requests.

Answer

Enable and configure AWS IAM Identity Center, set Google Workspace as an external identity provider using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) protocol.
AWS IAM Identity Center is the modern, recommended service for managing single sign-on access across a multi-account AWS environment. By integrating with Google Workspace as an external identity provider using SAML 2.0, developers can authenticate securely with their existing corporate credentials. Furthermore, configuring SCIM automatic provisioning automates user lifecycle management (creation, updates, and deletion), directly fulfilling the requirement to minimize operational complexity and automate user synchronization.

Step-by-Step Solution

1
Enable AWS IAM Identity Center in the AWS Organizations management account.
Centralized identity and access management is initialized across the entire multi-account environment.
This establishes a centralized management point for user access across all AWS accounts in the organization.
2
Configure SAML 2.0 federation between AWS IAM Identity Center and Google Workspace.
A trust relationship is established, allowing users to authenticate via their Google Workspace credentials.
SAML 2.0 enables secure single sign-on (SSO) federation, eliminating the need to manage duplicate passwords or long-term credentials in AWS.
3
Configure automatic user provisioning using the SCIM protocol between Google Workspace and AWS IAM Identity Center.
Users and groups are automatically synchronized from Google Workspace to AWS.
SCIM handles the lifecycle of users automatically, ensuring that when developers join or leave the agency, their AWS access is provisioned or revoked without manual intervention.

Key Concept

Centralized identity federation using AWS IAM Identity Center integrated with an external identity provider and automatic provisioning via SCIM.
Estimated Time:1m 30s
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic