A company wants to allow its on-premises employees to access the AWS Management Console using their existing corporate directory credentials instead of creating individual IAM users. Which of the following are required to configure this federated access? (Select TWO.)
- Create an IAM Identity Provider (IdP) in the AWS account to establish trust with the corporate directory.Cevap
- Create an IAM role that defines the permissions for the federated users.Cevap
- CCreate a unique IAM user for each employee and store their corporate passwords in AWS.
- DUse the AWS account root user credentials to configure a direct LDAP connection in the console.
- EAssign the federated users directly to an IAM group to manage their permissions.
Cevap
To configure federated access, you must create an IAM Identity Provider to establish trust with the corporate directory and create an IAM role that defines the permissions the federated users will assume.
Configuring federated access requires establishing trust between AWS and the corporate directory, which is accomplished by creating an Identity Provider (IdP) in IAM. Additionally, an IAM role must be created to define the exact permissions for these federated users when they log in to the console.
Adım Adım Çözüm
Anahtar Kavram
Identity federation in AWS IAM allows external identities to obtain temporary security credentials to access AWS resources without needing permanent IAM users.