A company is designing a federated identity solution for its developers who authenticate via an external SAML 2.0 compliant Identity Provider (IdP). The developers require single sign-on (SSO) access to multiple member accounts within their AWS Organizations environment. The solution must support automated user provisioning, minimize administrative overhead, and avoid manual creation of IAM users in each account. Which configuration strategy should the solutions architect recommend to meet these requirements?
- Configure AWS IAM Identity Center in the management account, integrated with the external SAML 2.0 IdP. Enable System for Cross-domain Identity Management (SCIM) in IAM Identity Center and configure the IdP to synchronize users and groups. Create permission sets in IAM Identity Center and assign them to the synchronized groups for target member accounts.Answer
- BConfigure the SAML 2.0 Identity Provider (IdP) in a central security account. In each target member account, create an IAM role with a trust policy that permits the sts:AssumeRoleWithSAML action and references the ARN of the SAML provider in the centralized security account. Attach a Service Control Policy (SCP) to the organization root that allows the federated users to assume these target roles.
- CCreate a SAML 2.0 Identity Provider (IdP) object in each target member account. In the external IdP, configure individual SAML client integrations for each member account. Create an IAM role in each member account with a trust policy that allows the sts:AssumeRole action for the SAML provider, and write a script to provision IAM users in each member account.
- DConfigure AWS IAM Identity Center in the management account and integrate it with the external SAML 2.0 IdP. Enable SCIM to synchronize users and groups. Attach a Service Control Policy (SCP) to target Organizational Units (OUs) that maps the external IdP groups to their allowed actions, thereby granting permissions without creating local roles or permission sets in the member accounts.
Answer
Configure AWS IAM Identity Center in the management account, integrate it with the external SAML 2.0 IdP, enable System for Cross-domain Identity Management (SCIM), and assign permission sets to the synchronized groups for target member accounts.
The correct configuration uses AWS IAM Identity Center integrated with the external IdP via SAML 2.0 and SCIM. This enables centralized identity management, automates provisioning, and uses permission sets to govern cross-account access, which minimizes administrative overhead.
Step-by-Step Solution
Key Concept
AWS IAM Identity Center (formerly AWS SSO) provides a centralized way to manage single sign-on access to multiple AWS accounts and SAML 2.0 business applications. Integrating it with an external IdP via SAML 2.0 and enabling SCIM allows centralized administration, automatic user provisioning, and mapping of groups to permission sets without the overhead of per-account configuration.