A financial services company is setting up a hybrid cloud environment. The company needs to allow its on-premises Active Directory users to log in to the AWS Management Console to manage Amazon EC2 instances. The security policy states that user credentials must not be stored or replicated in the AWS Cloud, and administrative effort must be minimized. Which two actions should a solutions architect take to meet these requirements? (Select two.)
- Enable AWS IAM Identity Center and configure it to use AWS Directory Service as the identity source.Cevap
- Configure an AD Connector in AWS Directory Service to redirect directory requests to the on-premises Active Directory.Cevap
- CCreate individual IAM users for each Active Directory user and generate long-term access keys.
- DUse the AWS account root user credentials to configure a shared login portal for all Active Directory users.
- EGenerate and distribute temporary security credentials derived from the AWS account root user access keys.
Cevap
Enabling AWS IAM Identity Center as the identity source and configuring AD Connector in AWS Directory Service to proxy authentication requests directly to the on-premises Active Directory.
The correct solution involves enabling AWS IAM Identity Center and connecting it to the on-premises Active Directory via an AD Connector. AD Connector functions as a gateway to forward authentication requests to the on-premises domain controllers without caching or replicating passwords in the AWS Cloud. AWS IAM Identity Center then maps those authenticated users to specific AWS IAM roles, minimizing operational overhead.
Adım Adım Çözüm
Anahtar Kavram
Using AD Connector alongside AWS IAM Identity Center allows organizations to federate their existing on-premises Active Directory to AWS without replicating credentials or introducing heavy management overhead.