Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is designing a new security strategy to grant its development team access to AWS resources. The developers are currently authenticated via an on-premises Active Directory. The solutions architect must implement a solution that allows developers to access the AWS Management Console and AWS CLI without introducing the administrative overhead of managing individual long-term credentials in AWS. Which solution should the solutions architect recommend to meet these requirements?

  1. Configure AWS IAM Identity Center to federate with the on-premises Active Directory, and assign AWS permission sets to the Active Directory groups.Answer
  2. B
    Create individual IAM users in the AWS account for each developer, and configure a custom synchronization script to copy Active Directory passwords to AWS.
  3. C
    Share the AWS account root user credentials with the lead developers, and configure Multi-Factor Authentication (MFA) using a shared hardware security key.
  4. D
    Store the Active Directory credentials as plaintext parameters in AWS Systems Manager Parameter Store, and write a client-side CLI script to retrieve them.

Answer

Configure AWS IAM Identity Center to federate with the on-premises Active Directory, and assign AWS permission sets to the Active Directory groups.
The correct solution uses AWS IAM Identity Center to federate with the on-premises Active Directory. This allows the organization to leverage existing user identities and group memberships. Security policies (permission sets) are mapped to these groups, enabling developers to sign in using their existing Active Directory credentials and obtain short-lived, temporary access keys for the AWS Management Console and CLI, which eliminates the administrative overhead of managing IAM users and long-term credentials.

Step-by-Step Solution

1
Establish federation between the on-premises Active Directory and AWS IAM Identity Center.
AWS IAM Identity Center trusts the Active Directory as the external Identity Provider (IdP) for user authentication.
This removes the need to recreate user identities in AWS and allows engineers to use single sign-on (SSO) with their existing enterprise credentials.
2
Create AWS IAM permission sets representing the access levels required by the development team.
Defined policies that grant specific permissions to perform actions on EC2 and RDS resources.
Permission sets define what actions federated users can perform once they sign into an AWS account.
3
Map the Active Directory developer groups to the corresponding AWS accounts and permission sets.
When developers authenticate through the IdP, they are dynamically assigned the appropriate IAM roles and temporary security credentials.
This automates access control, enforces the principle of least privilege, and avoids managing long-term AWS access keys.

Key Concept

Identity Federation and Single Sign-On (SSO) using AWS IAM Identity Center
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic