A biotechnology enterprise needs to grant its laboratory researchers single sign-on (SSO) access to multiple AWS accounts and several external third-party SaaS applications. The researchers currently authenticate using an on-premises Active Directory. The proposed architecture must minimize operational overhead, avoid replicating user passwords to the cloud, and enforce centralized access management. Which configuration meets these requirements?
- Enable AWS IAM Identity Center, connect it to the on-premises Active Directory using an AD Connector, and integrate both the AWS accounts and the SaaS applications with IAM Identity Center.Cevap
- BCreate individual IAM users in each AWS account for the laboratory researchers, configure their access permissions manually, and instruct them to use these credentials along with their Active Directory logins.
- CAccess the AWS management console using the root user credentials of each AWS account to configure individual SAML 2.0 federation endpoints directly linked to the on-premises Active Directory.
- DDeploy an authentication portal on Amazon EC2 that queries the on-premises Active Directory, storing the Active Directory service account password as a plain text string parameter in Systems Manager Parameter Store.
Cevap
Enable AWS IAM Identity Center, connect it to the on-premises Active Directory using an AD Connector, and integrate both the AWS accounts and the SaaS applications with IAM Identity Center.
Connecting AWS IAM Identity Center to the on-premises Active Directory via AD Connector provides centralized authentication without replicating password data. Furthermore, IAM Identity Center natively supports single sign-on (SSO) to both AWS accounts and SaaS applications, meeting all design constraints while keeping operational overhead low.
Adım Adım Çözüm
Anahtar Kavram
Centralized multi-account and SaaS identity federation using AWS IAM Identity Center connected to on-premises Active Directory via AD Connector.
Tahmini Süre:1m 30s