Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A real estate property management firm is migrating its internal operations to a multi-account AWS environment. The firm currently manages its 300 agents and administrative staff using an on-premises Microsoft Active Directory. A solutions architect must design a security architecture that allows these employees to log in to the AWS Management Console to manage resources across multiple AWS accounts. The solution must allow the employees to use their existing Active Directory credentials, enforce the organization's existing multi-factor authentication (MFA) policies, and minimize the administrative overhead of managing identities. Which solution should the solutions architect recommend to meet these requirements?

  1. A
    Create individual IAM users in each AWS account for the 300 employees, and write a script to continuously synchronize password hashes from the on-premises Active Directory.
  2. Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.Answer
  3. C
    Use the AWS account root user to create a centralized IAM group in the management account, assign the required permissions to the group, and distribute the root credentials to the directory administrators to manage user access.
  4. D
    Deploy AWS Directory Service for Microsoft Active Directory in the cloud, establish a two-way forest trust, and configure the on-premises user directories to generate long-term AWS access keys for each employee.

Answer

Enable AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector. Grant access to the AWS accounts using IAM Identity Center permission sets.
The correct answer is the option to enable AWS IAM Identity Center and connect it to the on-premises Active Directory using an AD Connector. This approach allows users to authenticate to the AWS Management Console using their existing corporate credentials without duplicating directory identities in AWS. AWS IAM Identity Center supports centralized management of permission sets and assigns AWS IAM roles to users when they log in, fulfilling all business and security requirements with the lowest operational overhead.

Step-by-Step Solution

1
Deploy AWS Directory Service AD Connector to establish a directory gateway with the on-premises Active Directory.
Authentication requests can be forwarded securely from AWS to the on-premises Active Directory without replicating directory data.
This bridges the on-premises directory and AWS services without local database synchronization overhead.
2
Enable AWS IAM Identity Center in the Organization's management account and configure the identity source to use the Active Directory via the AD Connector.
Users in the on-premises Active Directory can now be mapped directly to AWS IAM Identity Center and authenticate using their existing credentials and MFA.
This integrates the enterprise identity provider into AWS for single sign-on capabilities.
3
Create permission sets in AWS IAM Identity Center and associate them with Active Directory groups and AWS accounts.
Agents and administrative staff gain federated access to their respective AWS accounts with the correct permissions when logging in through the AWS access portal.
This implements role-based access control and minimizes administrative management overhead across a multi-account structure.

Key Concept

Centralized identity federation using AWS IAM Identity Center and AD Connector to integrate on-premises Active Directory without credential duplication.
Estimated Time:2m 0s
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic