Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A retail company is migrating its workloads to a multi-account AWS environment managed by AWS Organizations. The company wants to enable its 500 corporate employees to access their respective AWS accounts using their existing on-premises Active Directory (AD) credentials. The solution must minimize operational overhead, avoid replicating user credentials or directory metadata to the cloud, and provide centralized access control. Which solution meets these requirements?

  1. A
    Create individual IAM users in each target AWS account for all 500 corporate employees. Distribute access keys and configure a custom script to synchronize their on-premises Active Directory passwords to their IAM profiles.
  2. B
    Configure AWS IAM Identity Center. Export corporate user names and passwords from the on-premises Active Directory and store them as plaintext parameters in Systems Manager Parameter Store to allow AWS to authenticate the users.
  3. Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.Answer
  4. D
    Use the AWS account root user credentials to log in to each AWS account, then configure a SAML 2.0 integration directly with the on-premises Active Directory to allow administrative access.

Answer

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector, then define permission sets in IAM Identity Center to centrally manage access to the AWS accounts.
The correct solution uses AWS IAM Identity Center integrated with the on-premises Active Directory via AWS Directory Service AD Connector. AD Connector is a directory gateway that redirects directory requests to the on-premises Active Directory without caching or replicating credentials in the cloud. Using permission sets in IAM Identity Center allows administrators to centrally assign and manage permissions across the multi-account environment, minimizing operational overhead.

Step-by-Step Solution

1
Establish network connectivity and directory integration.
Connect AWS IAM Identity Center to the on-premises Active Directory by deploying AWS Directory Service AD Connector as a proxy gateway, which forwards authentication requests without local credential replication.
This establishes federated login capabilities using existing corporate credentials without storing or replicating passwords in AWS, satisfying the security and overhead requirements.
2
Configure AWS Organizations integration.
Enable AWS IAM Identity Center within the organization's management account to centrally oversee multi-account access.
Centralized governance via IAM Identity Center reduces operational overhead compared to configuring individual IAM configurations in each member account.
3
Define and assign permissions.
Create permission sets based on job functions and assign them to Active Directory groups to grant users access to specific AWS accounts.
This allows for role-based access control managed centrally, ensuring least privilege and simple access revocation.

Key Concept

Federating identity from an on-premises Active Directory to AWS using AWS Directory Service AD Connector and AWS IAM Identity Center to minimize operational overhead and avoid credential replication.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic