Examkin

Question

Difficulty: HardIdentity Federation and Directory Services

An advertising agency has a hybrid cloud architecture spanning an on-premises data center and a multi-account AWS environment managed under AWS Organizations. The agency manages its employee identities in an on-premises Microsoft Active Directory (AD) environment. The security team requires that employees use their existing AD credentials to access the AWS Management Console and the AWS CLI across different accounts. The solution must ensure that credentials are not replicated to the cloud, must support authentication redirection to the on-premises directory, and must integrate with their existing on-premises RADIUS server for multi-factor authentication (MFA) with minimal administrative overhead. Which solution meets these requirements?

  1. Enable AWS IAM Identity Center in the Organization's management account, configure an Active Directory directory source, and deploy an AWS Directory Service AD Connector to connect to the on-premises AD. Enable multi-factor authentication (MFA) on the AD Connector pointing to the on-premises RADIUS server.Answer
  2. B
    Deploy AWS Directory Service AD Connector to connect to the on-premises Active Directory, and write a script to dynamically create matching IAM users with long-term credentials in each AWS account, mapping Active Directory group memberships to IAM policies.
  3. C
    Use the AWS account root credentials in the Organization's management account to configure a custom SAML 2.0 identity provider (IdP) in each AWS account, and configure the on-premises AD to generate federated SAML assertions mapping directly to the root user.
  4. D
    Deploy AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) in a multi-region deployment, establish a two-way forest trust with the on-premises AD, and provision individual IAM users with virtual MFA devices enabled in the management account.

Answer

Enable AWS IAM Identity Center in the Organization's management account, configure an Active Directory directory source, and deploy an AWS Directory Service AD Connector to connect to the on-premises AD. Enable multi-factor authentication (MFA) on the AD Connector pointing to the on-premises RADIUS server.
The correct solution uses AWS IAM Identity Center combined with an AD Connector to federate identities from the on-premises Active Directory without replicating passwords or credentials. Since the AD Connector acts as a proxy, it redirects authentication requests back to the on-premises Active Directory and supports native integration with an on-premises RADIUS server for multi-factor authentication (MFA). This provides single sign-on access to both the console and CLI with minimal operational overhead.

Step-by-Step Solution

1
Enable AWS IAM Identity Center in the management account of AWS Organizations to centrally manage access to all AWS accounts.
Centralized access control capability is established across the organization.
Allows mapping AD groups to permission sets across multiple accounts without managing individual policies per account.
2
Deploy an AWS Directory Service AD Connector pointing to the on-premises Active Directory domain controllers.
A directory proxy is created that redirects authentication requests without replicating database records or credentials.
Meets the technical requirement of not replicating credentials to the cloud while utilizing the existing directory.
3
Configure the identity source in IAM Identity Center to use the deployed AD Connector.
IAM Identity Center is linked to the on-premises Active Directory.
Enables users to log in with their corporate credentials.
4
Configure Multi-Factor Authentication (MFA) on the AD Connector to redirect MFA validation requests to the on-premises RADIUS server.
MFA is enforced using the existing corporate RADIUS server.
Integrates with existing security mechanisms and satisfies the requirement to use the current RADIUS infrastructure.

Key Concept

AWS IAM Identity Center integration with on-premises Active Directory using AD Connector and RADIUS MFA
Estimated Time:2m 30s
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic