Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A global consulting firm is establishing a multi-account environment in AWS Organizations. The firm wants to grant its consultants access to client-specific AWS accounts. The firm manages its employee identities in an on-premises Active Directory. The solution must support single sign-on (SSO), minimize administrative overhead, and avoid replicating user credentials or passwords to AWS.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select two.)

  1. Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an AWS Directory Service AD Connector.Answer
  2. Create permission sets in AWS IAM Identity Center and map them to Active Directory groups to control access to specific AWS accounts.Answer
  3. C
    Create individual IAM users in each AWS account for all consultants and synchronize their passwords using a custom scheduled script.
  4. D
    Log in to the AWS account root user of each client account to manually configure cross-account IAM trust relationships and access keys for the consultants.
  5. E
    Deploy AWS Managed Microsoft AD in AWS and configure a synchronization script to replicate all on-premises Active Directory user accounts and passwords directly to AWS.

Answer

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using an AWS Directory Service AD Connector, and create permission sets in AWS IAM Identity Center and map them to Active Directory groups to control access.
Connecting AWS IAM Identity Center to the on-premises Active Directory using an AD Connector provides a seamless directory gateway that forwards authentication requests to the on-premises directory, satisfying the requirements to avoid password replication and minimize operational overhead. Creating permission sets in AWS IAM Identity Center and mapping them to Active Directory groups allows centralized, role-based access control across multiple AWS accounts.

Step-by-Step Solution

1
Select the identity source in AWS IAM Identity Center.
AWS IAM Identity Center is configured to use an external identity provider or directory.
This establishes a centralized single sign-on mechanism for the multi-account AWS environment.
2
Connect the on-premises Active Directory using AWS Directory Service AD Connector.
Authentication requests are redirected to the on-premises Active Directory without copying credentials.
Using AD Connector avoids password replication and minimizes operational overhead by acting as a directory gateway.
3
Create permission sets in AWS IAM Identity Center and map them to Active Directory groups.
Consultants are granted access to specific AWS accounts based on their existing group memberships.
This automates user provisioning and ensures least-privilege access is maintained dynamically.

Key Concept

Centralized identity federation using AWS IAM Identity Center and AD Connector to federate on-premises directory users without password replication.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic