Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

A company is implementing a multi-account strategy using AWS Organizations. The company wants to centralize access management to all AWS accounts by integrating AWS IAM Identity Center with their external identity provider (IdP), Okta, which supports SAML 2.0 and SCIM. The solutions architect needs to configure automatic synchronization of users and groups from Okta to AWS, and assign permissions to these users. Which two configurations should the solutions architect implement to meet these requirements?

  1. Enable SAML 2.0 identity federation in AWS IAM Identity Center by exchanging metadata documents with Okta, and configure automatic provisioning using System for Cross-domain Identity Management (SCIM) by generating a SCIM endpoint and access token in IAM Identity Center and configuring them in Okta.Answer
  2. Create permission sets within AWS IAM Identity Center containing the required IAM policies, and assign these permission sets to the synchronized Okta groups within the target AWS accounts in the organization.Answer
  3. C
    Create an IAM SAML identity provider in each target AWS account, configure a trust relationship using the sts:AssumeRoleWithSAML action, and map Okta groups to local IAM roles in each account individually.
  4. D
    Create Service Control Policies (SCPs) at the root of AWS Organizations to define the permitted IAM actions for each synchronized Okta group, relying on SCP inheritance to grant permissions across accounts without local IAM policies or permission sets.

Answer

The solutions architect must enable SAML 2.0 identity federation in AWS IAM Identity Center and configure SCIM provisioning for automatic synchronization. Additionally, they must create permission sets in IAM Identity Center and assign them to the synchronized groups in the target AWS accounts.
Centralizing access management using AWS IAM Identity Center requires configuring an external identity provider via SAML 2.0 and enabling SCIM for automatic provisioning of users and groups. To grant permissions, a solutions architect must create permission sets in IAM Identity Center and assign them to the synchronized groups for specific target AWS accounts.

Step-by-Step Solution

1
Configure identity source in AWS IAM Identity Center to use an external identity provider (Okta) and exchange SAML metadata to establish trust.
Federated authentication is established between Okta and AWS IAM Identity Center.
Allows users to authenticate to AWS using their existing Okta credentials.
2
Enable SCIM provisioning in AWS IAM Identity Center, copy the SCIM endpoint and access token, and configure provisioning in Okta.
Users and groups from Okta are automatically synchronized to AWS IAM Identity Center.
Ensures that group membership changes in Okta are automatically reflected in AWS without manual intervention.
3
Create permission sets in AWS IAM Identity Center and assign them to the synchronized groups within specific target AWS accounts.
Synchronized users gain the appropriate access levels to their assigned AWS accounts based on their Okta group membership.
Centralizes permission management across the multi-account AWS Organization.

Key Concept

AWS IAM Identity Center with external SAML IdP and SCIM provisioning
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic