A game development studio is migrating its build pipelines and testing environments to AWS. The studio manages all employees using an on-premises Microsoft Active Directory domain. The solutions architect must implement a single sign-on (SSO) solution that allows developers to access their respective AWS accounts within AWS Organizations using their existing on-premises credentials. The solution must minimize operational overhead, require no password replication to the cloud, and avoid manually managing long-term AWS credentials. Which two actions should the solutions architect take to meet these requirements? (Select two.)
- Deploy an AWS Directory Service AD Connector to establish a gateway that redirects directory requests to the on-premises Active Directory.Cevap
- Enable AWS IAM Identity Center and configure the identity source to use the Active Directory directory connected via AD Connector.Cevap
- CManually create individual IAM users in each AWS account for the developers and configure them to federate with the on-premises Active Directory.
- DUse the AWS Organizations management account root user to set up a shared cross-account role and distribute the root credentials to senior developers.
Cevap
Deploy an AWS Directory Service AD Connector to redirect directory requests to the on-premises Active Directory, and configure AWS IAM Identity Center to use that directory as the identity source.
To integrate an on-premises Microsoft Active Directory with AWS for user access without replicating password hashes, the best approach is to deploy an AD Connector. The AD Connector acts as a proxy, directing authentication requests back to the on-premises directory. By enabling AWS IAM Identity Center and configuring it to point to the AD Connector directory, users can sign in using their corporate credentials and gain access to their assigned AWS accounts seamlessly.
Adım Adım Çözüm
Anahtar Kavram
AWS Directory Service AD Connector and AWS IAM Identity Center integration for hybrid directory federation