Examkin

Question

Difficulty: MediumIdentity Federation and Directory Services

A manufacturing company is migrating its workloads to a multi-account environment on AWS managed by AWS Organizations. The company maintains an on-premises Microsoft Active Directory containing all employee accounts. The company wants to allow its security administrators to log in to the AWS Management Console and access the AWS CLI using their existing corporate credentials. The solution must minimize operational overhead, avoid replicating Active Directory passwords to the cloud, and support centralized permission management. Which combination of actions should the solutions architect recommend to meet these requirements? (Select two.)

  1. Enable AWS IAM Identity Center in the Organizations management account and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.Answer
  2. Create permission sets in AWS IAM Identity Center and assign them to the mapped Active Directory groups to control access to AWS resources.Answer
  3. C
    Create individual IAM users in each target AWS account, configure long-term credentials for each user, and assign them to IAM groups that mimic the on-premises directory structure.
  4. D
    Log in to the AWS account root user of each member account to configure a custom SAML 2.0 identity provider pointing to the on-premises directory.

Answer

The correct configuration involves enabling AWS IAM Identity Center in the Organizations management account, connecting it to the on-premises directory via an AD Connector, and creating permission sets mapped to Active Directory groups.
Enabling AWS IAM Identity Center and using an AD Connector provides a secure, low-overhead gateway to redirect authentication requests to the on-premises directory without replicating passwords or credentials to AWS. Mapping permission sets centrally to Active Directory groups allows administrators to govern access across all member accounts from a single location.

Step-by-Step Solution

1
Identify the correct federation service for multi-account management.
AWS IAM Identity Center is selected over individual IAM configurations to provide single sign-on capabilities across the AWS Organization.
IAM Identity Center is the modern AWS recommendation for centralizing multi-account access.
2
Establish connectivity to the on-premises Active Directory without password replication.
Deploy an AWS Directory Service AD Connector to act as a directory gateway.
AD Connector redirects authentication requests directly to the on-premises Active Directory, ensuring no passwords or hashes are replicated to the cloud.
3
Map Active Directory groups to AWS permissions.
Create permission sets in AWS IAM Identity Center and associate them with mapped AD groups.
This allows group-based authorization, matching existing corporate governance structures.

Key Concept

Centralized multi-account access management using AWS IAM Identity Center integrated with an on-premises Active Directory via AD Connector.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic