A biopharmaceutical corporation is designing a hybrid cloud architecture to connect its on-premises Microsoft Active Directory domain with a newly deployed multi-account AWS environment managed via AWS Organizations. The corporation requires corporate employees to authenticate using their existing Active Directory credentials to access resources across all AWS accounts. The solution must minimize administrative overhead, avoid synchronizing or replicating user passwords to the cloud, and support centralized permission management.
Which combination of actions will meet these requirements? (Select two.)
- Deploy an AWS Directory Service AD Connector to connect to the on-premises Active Directory domain controllers.Answer
- Enable AWS IAM Identity Center in the Organizations management account and configure it to use the AD Connector directory as the identity source.Answer
- CCreate individual IAM users in a centralized security account for each Active Directory user and configure cross-account IAM roles for access.
- DUse the AWS account root user credentials of the management account to configure SAML 2.0 federation endpoints in each member account.
Answer
Deploy an AWS Directory Service AD Connector to connect to the on-premises Active Directory, and enable AWS IAM Identity Center in the Organizations management account, configuring it to use the AD Connector directory as the identity source.
Deploying an AWS Directory Service AD Connector allows AWS to proxy authentication requests directly to the on-premises Active Directory domain controllers without replicating credentials to the cloud. Combining this with AWS IAM Identity Center provides centralized federation and access management across all AWS accounts in the organization, meeting all requirements with minimal administrative overhead.
Step-by-Step Solution
Key Concept
Centralized hybrid identity federation using AWS Directory Service AD Connector and AWS IAM Identity Center