Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

An organization needs to grant console access to its team of internal software developers. The developers already authenticate daily using the company's central Active Directory. Which approach represents the most secure method for granting AWS Management Console access to these developers?

  1. A
    Share the AWS account root user credentials with the lead developers and have them manage IAM settings for the rest of the team.
  2. Configure identity federation using AWS IAM Identity Center to map Active Directory groups to AWS permissions.Answer
  3. C
    Create individual IAM users in the AWS account for each developer and configure passwords for console access.
  4. D
    Create a single shared administrative IAM user, generate its access key, and save it in Systems Manager Parameter Store as a plain text string parameter for developers to retrieve.

Answer

Configure identity federation using AWS IAM Identity Center to map Active Directory groups to AWS permissions.
The correct approach is to configure identity federation using AWS IAM Identity Center. This maps the company's existing Active Directory groups directly to AWS permissions, allowing developers to authenticate using their existing corporate credentials. This adheres to the principle of least privilege, minimizes administrative overhead, and avoids the creation of long-term IAM user credentials.

Step-by-Step Solution

1
Identify the existing identity store used by the developers.
The developers are already authenticated using the company's central Active Directory.
This indicates that identity federation is the preferred approach to avoid credential duplication.
2
Select the appropriate AWS service for centralized identity management and federation.
AWS IAM Identity Center is the recommended service for directory federation.
It integrates directly with Active Directory to manage single sign-on access to AWS accounts and applications.
3
Evaluate the security implications of alternative options.
Creating individual IAM users, sharing root credentials, or storing keys in plaintext parameters violate AWS security best practices.
These alternatives introduce credential management overhead, violate the principle of least privilege, and expose sensitive credentials.

Key Concept

AWS identity federation using IAM Identity Center allows organizations to grant AWS access based on existing corporate directory identities without managing separate IAM user credentials.
Estimated Time:1m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic