Examkin

Question

Difficulty: HardIdentity Federation and Directory Services

A global manufacturing enterprise is migrating its legacy ERP and supply chain applications to a multi-account AWS environment managed by AWS Organizations. The company's identity provider (IdP) is an on-premises Microsoft Active Directory domain. The enterprise security policy requires that all employee authentication must occur against the on-premises Active Directory, and users must be able to access the AWS Management Console with their corporate credentials without duplicating identities in the cloud. The solution must minimize operational overhead. Which two actions should the solutions architect take to meet these requirements? (Select two.)

  1. Enable AWS IAM Identity Center and configure it to use the AD Connector as the identity source for user authentication.Answer
  2. Deploy an Active Directory Connector (AD Connector) in the AWS VPC to proxy authentication requests to the on-premises Active Directory.Answer
  3. C
    Create individual IAM users in each AWS account with long-term security credentials for every Active Directory user who requires console access.
  4. D
    Configure AWS IAM Identity Center to store user credentials in Systems Manager Parameter Store as plaintext parameters for cross-account synchronization.
  5. E
    Use the AWS account root user credentials to set up a SAML 2.0 federation trust directly between each AWS account and the on-premises Active Directory.

Answer

Deploy an Active Directory Connector (AD Connector) in the AWS VPC to proxy authentication requests, and enable AWS IAM Identity Center configured to use the AD Connector as the identity source.
Deploying an Active Directory Connector (AD Connector) provides a directory gateway that redirects authentication requests to the on-premises Active Directory domain controllers, ensuring no credentials are cached or stored in AWS. Enabling AWS IAM Identity Center and configuring it to use the AD Connector as its identity source allows users to authenticate centrally and access resources across multiple accounts in AWS Organizations using their existing corporate credentials with minimum operational complexity.

Step-by-Step Solution

1
Set up network connectivity between the AWS VPC and the on-premises network, then deploy an Active Directory Connector (AD Connector).
The AD Connector acts as a directory gateway that proxies authentication requests directly to the on-premises Active Directory without caching credentials in AWS.
This meets the requirement of using corporate credentials without duplicating identities or credentials in the cloud.
2
Enable AWS IAM Identity Center in the AWS Organizations management account.
Centralized single sign-on access is established for the multi-account environment.
AWS IAM Identity Center simplifies multi-account access management and reduces operational overhead.
3
Configure AWS IAM Identity Center to use the deployed AD Connector as the identity source.
On-premises Active Directory users are mapped to AWS permissions and can log in to the console using their corporate credentials.
This completes the integration with minimal operational overhead.

Key Concept

AWS IAM Identity Center integration with on-premises Active Directory using Active Directory Connector (AD Connector) for federated multi-account access.
Rate this question

Topics

Identity Federation and Directory Services

More questions from this topic