Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A retail technology startup has a multi-account AWS environment managed under AWS Organizations. The startup uses Okta as its central Identity Provider (IdP) for employee authentication. The security team wants to grant developers single sign-on (SSO) access to their respective AWS accounts. The solution must ensure that user access is automatically provisioned and deprovisioned when users are added or removed in Okta, while minimizing operational complexity and eliminating the use of long-term credentials. Which solution meets these requirements?

  1. A
    Create individual IAM users with long-term credentials in each AWS account for the developers, and write a nightly synchronization script using the AWS SDK to create or delete IAM users based on changes in Okta.
  2. Enable AWS IAM Identity Center, configure Okta as an external identity provider (IdP) using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol.Answer
  3. C
    Enable access keys for the AWS Organizations management account root user, and write a centralized script that uses these keys to assume cross-account IAM roles in the member accounts for the developers.
  4. D
    Store the developers' Okta credentials as plaintext parameters in Systems Manager Parameter Store, and trigger an AWS Lambda function to provision temporary IAM users on demand.

Answer

Enable AWS IAM Identity Center, configure Okta as an external identity provider (IdP) using SAML 2.0, and configure automatic provisioning using the System for Cross-domain Identity Management (SCIM) v2.0 protocol.
The correct solution uses AWS IAM Identity Center to federate Okta as an external Identity Provider (IdP) via SAML 2.0. This allows users to authenticate using their corporate credentials. Enabling System for Cross-domain Identity Management (SCIM) v2.0 ensures that user provisioning and deprovisioning are handled automatically when accounts are modified in Okta, meeting the requirement to minimize operational complexity without using long-term credentials.

Step-by-Step Solution

1
Select AWS IAM Identity Center as the central service for managing SSO access across multiple accounts in AWS Organizations.
Establishes a centralized identity hub that eliminates the need to configure IAM resources individually in every account.
Reduces operational complexity and simplifies management.
2
Configure SAML 2.0 federation between AWS IAM Identity Center and Okta.
Enables single sign-on using Okta as the authoritative identity provider.
Allows developers to authenticate with their existing corporate credentials without using long-term AWS IAM credentials.
3
Enable and configure automatic provisioning using the SCIM v2.0 protocol in AWS IAM Identity Center and Okta.
Automatically synchronizes user accounts, group memberships, and status updates.
Ensures that when a user is added to or removed from Okta, their access in AWS is immediately granted or revoked, maintaining security and compliance.

Key Concept

Centralized Identity Federation with Automatic SCIM Provisioning
Estimated Time:1m 30s
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic