Examkin

Question

Difficulty: MediumMulti-Account Identity and Access Management Federation

An enterprise is consolidating its identity management across 50 AWS accounts managed under AWS Organizations. Currently, each member account has a separate IAM SAML 2.0 identity provider (IdP) configured to federate with the corporate Okta directory. The administration of managing these individual identity providers and mapping IAM roles locally has become operationally inefficient. The solutions architect must implement a centralized identity federation strategy that simplifies administration and automates user provisioning from Okta. Which strategy should the solutions architect select?

  1. Enable AWS IAM Identity Center in the Organizations management account. Configure Okta as the external identity provider using SAML 2.0 for authentication and System for Cross-domain Identity Management (SCIM) for automatic user and group provisioning. Define permission sets in IAM Identity Center to manage access to member accounts.Answer
  2. B
    Define a single IAM role in each member account. Apply a Service Control Policy (SCP) at the organization root that allows the external Okta identity provider to assume these IAM roles directly based on Okta group assertions, eliminating the need for local trust relationships.
  3. C
    Centralize federation by creating a single IAM identity provider in a dedicated Shared Services account linked to Okta. Configure IAM roles in the member accounts with a trust policy that allows federated access from Okta using the sts:AssumeRole action instead of sts:AssumeRoleWithSAML.
  4. D
    Use AWS Resource Access Manager (RAM) to share a single IAM SAML identity provider from a Shared Services account to all member accounts. Instruct users to authenticate to the shared provider and assume local roles.

Answer

Enable AWS IAM Identity Center in the Organizations management account, configure Okta as the external identity provider using SAML 2.0 for authentication and SCIM for provisioning, and manage access using permission sets.
The correct strategy uses AWS IAM Identity Center to centralize identity federation and permissions across the entire AWS Organization. Integrating with Okta via SAML 2.0 handles authentication, while implementing SCIM ensures that user accounts and group memberships are automatically synchronized from Okta to AWS, resolving the operational overhead of manual role mapping in each individual account.

Step-by-Step Solution

1
Centralize identity management with AWS IAM Identity Center.
Configured AWS IAM Identity Center in the Organizations management account to act as a single point of entry and administration for access across all member accounts.
This removes the overhead of managing individual IAM SAML providers and roles in each of the 50 separate accounts.
2
Establish federation and automatic provisioning with Okta.
Configured Okta as the external identity provider using SAML 2.0 for federated authentication, and enabled SCIM synchronization.
SCIM automates the creation, modification, and deletion of users and groups in AWS based on changes in the Okta directory, ensuring synchronization and reducing administrative overhead.
3
Define and assign permissions centralized in IAM Identity Center.
Created permission sets that specify the level of access users have, and assigned them to Okta groups and specific AWS accounts.
This delegates access management to IAM Identity Center, allowing policy administration from a single plane rather than modifying individual IAM roles locally in each account.

Key Concept

AWS IAM Identity Center integration with external Identity Providers (IdP) like Okta using SAML 2.0 and SCIM for automated provisioning across a multi-account organization.
Estimated Time:1m 30s
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic