An enterprise company wants to grant its employees access to multiple AWS accounts within AWS Organizations. The company uses an external identity provider (IdP) that supports SAML 2.0 to manage its workforce. The company wants to minimize administrative overhead and avoid creating duplicate credentials.
Which solution meets these requirements with the least operational complexity?
- Enable AWS IAM Identity Center, connect it to the external identity provider via SAML 2.0, and map corporate groups to AWS permission sets in the target accounts.Cevap
- BCreate individual IAM users in each AWS account for every corporate employee, and write an automation script to rotate their long-term access keys.
- CCreate a single shared IAM user in each AWS account, generate access keys for all employees, and configure policy boundaries on the shared user.
- DUse the AWS account root user credentials of the Organization management account to perform all daily administrative tasks across all member accounts.
Cevap
Enable AWS IAM Identity Center, connect it to the external identity provider via SAML 2.0, and map corporate groups to AWS permission sets in the target accounts.
Configuring AWS IAM Identity Center with a SAML 2.0 external identity provider enables single sign-on (SSO) across multiple AWS accounts. By mapping corporate groups to AWS permission sets, administrators can grant permissions centrally, eliminating the need to create individual IAM users or credentials in each account.
Adım Adım Çözüm
Anahtar Kavram
AWS IAM Identity Center provides centralized management of SSO access to multiple AWS accounts and SAML applications using an external IdP.