Examkin

Question

Difficulty: HardIdentity Federation and Directory Services

A digital media corporation is migrating its workflows to a multi-account environment managed by AWS Organizations. The company utilizes Microsoft Entra ID as its central identity provider. The security team requires that access to the AWS Management Console be authenticated against Entra ID, and that group memberships in Entra ID automatically determine the AWS permissions granted to users without manually creating IAM users in individual accounts. The solution must minimize operational overhead. Which two actions should a solutions architect take to meet these requirements? (Select two.)

  1. Enable AWS IAM Identity Center in the organization's management account and configure an external identity provider using SAML 2.0 federation.Answer
  2. Configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol between Microsoft Entra ID and AWS IAM Identity Center.Answer
  3. C
    Deploy an AD Connector in a transit VPC to bridge Microsoft Entra ID, then configure AWS IAM Identity Center to query user groups via LDAP.
  4. D
    Create a custom SAML 2.0 identity provider in the IAM console of each AWS account, and write a synchronization script to replicate users into local IAM groups.
  5. E
    Establish an AWS Managed Microsoft AD domain and configure a two-way active directory forest trust directly to the Microsoft Entra ID tenant.

Answer

The correct actions are enabling AWS IAM Identity Center with SAML 2.0 federation to an external identity provider, and configuring automatic provisioning via the System for Cross-domain Identity Management (SCIM) v2.0 protocol.
AWS IAM Identity Center simplifies multi-account access management by allowing centralized single sign-on. By configuring Microsoft Entra ID as an external SAML 2.0 identity provider, users can authenticate using their existing credentials. Using SCIM v2.0 automates the provisioning of users and groups from Microsoft Entra ID to AWS IAM Identity Center, mapping Entra ID groups directly to permission sets in AWS without manual intervention.

Step-by-Step Solution

1
Determine the identity source and centralized portal requirement.
AWS IAM Identity Center is selected as the recommended service for centralized access across multiple AWS accounts.
IAM Identity Center integrates with AWS Organizations to manage multi-account permissions from a single place, minimizing operational overhead.
2
Establish trust between AWS IAM Identity Center and Microsoft Entra ID.
SAML 2.0 federation is configured to delegate authentication to Microsoft Entra ID as the external Identity Provider.
This allows users to authenticate using their existing Entra ID credentials without storing or replicating passwords in AWS.
3
Automate user and group provisioning.
SCIM v2.0 is enabled to automatically synchronize user accounts and group memberships into IAM Identity Center.
SCIM enables automatic synchronization of identity changes and group mappings, eliminating the need to manually create local IAM users.

Key Concept

Centralized multi-account identity federation using AWS IAM Identity Center and external SAML/SCIM providers.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic