Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A media streaming company is migrating its operations to AWS and setting up a multi-account environment managed by AWS Organizations. The company's developers need single sign-on (SSO) access to the AWS Management Console. The company maintains an on-premises Microsoft Active Directory to manage developer identities. The solution must minimize operational overhead, avoid the replication of Active Directory passwords to the AWS Cloud, and leverage existing Active Directory group memberships to control access permissions.

Which solution should a solutions architect recommend to meet these requirements?

  1. A
    Manually create individual IAM users with long-term credentials in each AWS account for all developers, and run a daily cron job to sync credentials from the on-premises Active Directory.
  2. Configure AWS IAM Identity Center, connect it to the on-premises Active Directory using AWS Directory Service AD Connector, and map the Active Directory groups to permission sets in IAM Identity Center.Answer
  3. C
    Enable SAML 2.0 federation directly on the AWS account root user of the management account, and share the root credentials with developers to manage resources across all member accounts.
  4. D
    Deploy a custom synchronization application on Amazon EC2 that queries the on-premises Active Directory to create matching IAM users, and store the Active Directory service account password as a plaintext parameter in AWS Systems Manager Parameter Store.

Answer

Configure AWS IAM Identity Center, connect it to the on-premises Active Directory using AWS Directory Service AD Connector, and map the Active Directory groups to permission sets in IAM Identity Center.
Configuring AWS IAM Identity Center with AWS Directory Service AD Connector is the most efficient design to achieve single sign-on for on-premises Active Directory users in a multi-account environment. AD Connector acts as a directory gateway to forward authentication requests to the on-premises AD without replicating passwords to the AWS Cloud. Mapping AD groups to permission sets in IAM Identity Center ensures access control is centrally managed and leverages existing directory structures, minimizing operational overhead.

Step-by-Step Solution

1
Assess the need for centralized single sign-on (SSO) and minimal overhead in a multi-account setup.
Identify AWS IAM Identity Center as the recommended AWS service for centralized multi-account access.
AWS IAM Identity Center simplifies SSO access across AWS accounts and integrates with external identity providers.
2
Determine the directory integration method that avoids password replication and minimizes infrastructure management.
Choose AWS Directory Service AD Connector to redirect authentication requests to the on-premises Active Directory.
AD Connector acts as a directory gateway, proxying authentication requests without caching or replicating AD passwords in AWS.
3
Assign permissions based on existing on-premises groups.
Map Active Directory groups to permission sets in IAM Identity Center.
This leverages existing group structures to assign permissions to users dynamically as they authenticate, avoiding manual credential management.

Key Concept

Centralized multi-account access using AWS IAM Identity Center and AD Connector to federate with on-premises Active Directory without password replication.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic