Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is migrating its internal resource scheduling application to AWS. The company's employees currently authenticate using an on-premises Active Directory. A solutions architect must design an access control solution that allows employees to sign in to the AWS Management Console using their existing corporate credentials, without introducing long-term AWS credentials or administrative overhead.

Which solution meets these requirements?

  1. Configure AWS IAM Identity Center and establish a SAML 2.0 identity federation between the on-premises Active Directory and AWS.Answer
  2. B
    Create individual IAM users in the AWS account for each employee, and implement a synchronization script to replicate on-premises password changes to AWS.
  3. C
    Use the AWS Account Root User credentials to generate access keys, and distribute them to employees to configure their local AWS CLI profiles.
  4. D
    Store the corporate LDAP credentials in Systems Manager Parameter Store as plaintext String parameters, and configure an IAM role to read these parameters during authentication.

Answer

Configure AWS IAM Identity Center and establish a SAML 2.0 identity federation between the on-premises Active Directory and AWS.
Establishing SAML 2.0 identity federation via AWS IAM Identity Center is the standard, secure, and recommended pattern for integrating an on-premises Active Directory with AWS. It allows employees to use their existing credentials to log in, and relies on AWS Security Token Service (STS) to generate temporary credentials, eliminating the need to manage static AWS IAM users and credentials.

Step-by-Step Solution

1
Evaluate the requirement for corporate directory integration without long-term AWS credentials.
Identify SAML 2.0 identity federation as the standard mechanism to map external corporate directory identities to AWS temporary credentials.
Federation enables single sign-on (SSO) and relies on short-term STS credentials rather than permanent IAM user credentials.
2
Select the appropriate AWS service for centralized single sign-on and directory integration.
Identify AWS IAM Identity Center (formerly AWS Single Sign-On) as the modern and recommended service for this scenario.
IAM Identity Center integrates out-of-the-box with SAML 2.0 providers and manages access permissions across multiple accounts from a single location.
3
Eliminate options that use long-term IAM users or root account credentials.
Discard solutions proposing individual IAM users or root access keys as they increase security risk and management overhead.
These violate the principle of least privilege and fail to meet the constraint of avoiding long-term credentials.

Key Concept

AWS Directory Federation and IAM Identity Center
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic