An enterprise is migrating its applications to a multi-account environment managed by AWS Organizations. The company's security policy requires corporate users to authenticate using their existing on-premises Active Directory credentials to access the AWS Management Console of various AWS accounts. The solution must enforce multi-factor authentication (MFA), minimize operational overhead, and avoid synchronizing passwords or user directory data to the cloud. Which two actions should a solutions architect take to implement this architecture? (Select two.)
- Enable AWS IAM Identity Center in the organization's management account and configure it to use Active Directory as the identity source.Answer
- Deploy an AWS Directory Service AD Connector in a VPC with VPN or Direct Connect connectivity to the on-premises domain controllers to proxy authentication requests.Answer
- CProvision individual IAM users in each member account for all Active Directory users, assigning long-term access keys and console passwords to each user.
- DUse the AWS account root user credentials of each AWS account to configure individual SAML 2.0 identity providers pointing to the on-premises Active Directory.
Answer
Enable AWS IAM Identity Center in the organization's management account and configure it to use Active Directory as the identity source, and deploy an AWS Directory Service AD Connector in a VPC with network connectivity to on-premises domain controllers to proxy authentication requests.
Centralizing access control through AWS IAM Identity Center enabled in the organization's management account satisfies the enterprise requirement to manage access across multiple accounts. Pairing it with AD Connector provides a secure authentication proxy that forwards requests directly to the on-premises domain controllers via VPN or Direct Connect, ensuring passwords and directory data are not synchronized or replicated to AWS.
Step-by-Step Solution
Key Concept
Centralized multi-account federation using AWS IAM Identity Center coupled with AD Connector to leverage on-premises Active Directory without password synchronization.