Examkin

Soru

Zorluk: OrtaIdentity Federation and Directory Services

An insurance company manages a multi-account environment on AWS using AWS Organizations. The company wants to allow its on-premises Active Directory users to access resources across these accounts using their existing corporate credentials. The solution must minimize operational overhead, avoid user data replication, and allow central management of permissions. Which of the following actions should the solutions architect take to meet these requirements? (Select two.)

  1. Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector.Cevap
  2. Create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.Cevap
  3. C
    Create individual IAM users in each target AWS account for every Active Directory user and implement a script to synchronize passwords periodically.
  4. D
    Generate access keys for the AWS account root user of the Organizations management account and share them with the Active Directory administrators for cross-account management.
  5. E
    Store the Active Directory administrator credentials as plaintext String parameters in AWS Systems Manager Parameter Store to automate cross-account role assumption.

Cevap

Configure AWS IAM Identity Center and connect it to the on-premises Active Directory using AWS Directory Service AD Connector, then create permission sets within AWS IAM Identity Center and associate them with the Active Directory groups mapping to the target AWS accounts.
The correct solution involves configuring AWS IAM Identity Center with AWS Directory Service AD Connector to link the on-premises Active Directory to AWS without replicating credentials. Additionally, permission sets must be created in AWS IAM Identity Center and assigned to the AD groups to grant access to the member accounts in the organization. This fulfills all requirements of centralized management, zero data replication, and low operational overhead.

Adım Adım Çözüm

1
Establish connectivity between AWS and the on-premises directory.
AWS Directory Service AD Connector is deployed, redirecting directory authentication requests to the on-premises Active Directory without copying credentials.
This establishes directory integration without user database replication and minimizes operational overhead.
2
Configure AWS IAM Identity Center to use the AD Connector as its identity source.
AWS IAM Identity Center points to the Active Directory, allowing it to read groups and users directly.
This enables centralized login portal access for Active Directory users.
3
Create permission sets and assign them to the mapped groups.
Permissions are centrally defined as permission sets and linked to the corresponding AD groups inside the target AWS accounts.
This satisfies the requirement for central management of permissions.

Anahtar Kavram

AWS IAM Identity Center federation with on-premises Active Directory via AD Connector enables seamless single sign-on while keeping user credentials within the local directory and allowing centralized permission control via permission sets.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Identity Federation and Directory Services

Bu konudan daha fazla soru