Examkin

Question

Difficulty: Very hardIdentity Federation and Directory Services

A logistics enterprise with a multi-account structure in AWS Organizations wants to implement centralized single sign-on (SSO) for its on-premises Active Directory (AD) users. The company's compliance policy strictly prohibits replicating user password hashes to AWS or deploying Microsoft Active Directory domain controllers inside the cloud environment. A dedicated AWS Direct Connect connection provides private network pathing to the on-premises environment. The solutions architect needs to design a secure, highly available identity federation solution that allows users to access the AWS Management Console of member accounts using their corporate AD credentials. Which two actions should the solutions architect take to meet these requirements? (Select two.)

  1. Configure an AD Connector in the AWS Organizations management account across two Availability Zones, providing the IP addresses of the on-premises Active Directory domain controllers for name resolution and authentication.Answer
  2. Enable AWS IAM Identity Center and change the identity source from the default identity store to the Active Directory directory associated with the newly deployed AD Connector.Answer
  3. C
    Create matching IAM users with long-term access keys in each AWS Organizations member account, and run a synchronization script to replicate passwords from the on-premises Active Directory.
  4. D
    Provision an AWS Managed Microsoft AD directory in a dedicated shared services VPC, set up a two-way forest trust, and configure AWS Directory Service to synchronize all password hashes to the cloud.
  5. E
    Configure SAML 2.0 identity provider federation directly on the AWS Organizations management account's root user, using Active Directory Federation Services (ADFS) to bypass IAM role delegation.

Answer

To establish federation without replicating passwords or deploying cloud domain controllers, the solutions architect must configure an AD Connector across multiple Availability Zones pointing to the on-premises Active Directory, and configure AWS IAM Identity Center to use this Active Directory directory as its identity source.
Deploying AD Connector allows AWS to proxy authentication requests to the on-premises Active Directory domain controllers without storing password hashes in AWS or requiring domain controller deployments in the cloud. By changing the identity source in AWS IAM Identity Center to use this Active Directory directory, users can authenticate using their existing on-premises credentials to access the AWS Management Console across all accounts within the AWS Organization.

Step-by-Step Solution

1
Evaluate the architectural constraints concerning password storage and domain controller deployment.
Identify that AWS Managed Microsoft AD is unsuitable because it deploys domain controllers in the AWS Cloud, leaving AD Connector as the correct choice for proxying authentication requests.
Compliance rules prohibit replicating password hashes to the cloud and deploying new domain controllers in AWS.
2
Provision AD Connector in a highly available configuration.
Create the AD Connector across two Availability Zones in the primary VPC, configuring it with the IP addresses of the on-premises domain controllers accessible via the AWS Direct Connect connection.
Multi-AZ deployment ensures service availability, and routing traffic over the Direct Connect ensures secure, private communication.
3
Configure the identity source in AWS IAM Identity Center.
Navigate to the IAM Identity Center console, select the option to change the identity source, and connect it to the Active Directory directory provisioned by the AD Connector.
This establishes the link between IAM Identity Center and the on-premises Active Directory domain, allowing seamless user access without provisioning local IAM users.

Key Concept

Integrating on-premises Active Directory with AWS IAM Identity Center using AD Connector allows secure, high-availability federation without password replication or cloud-based domain controller deployments.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic