ANS-C01 Question 265
Select 3Your company has an on-premises Active Directory (AD) and uses AWS for hosting critical applications. You want to enable Single Sign-On (SSO) for your employees to access the AWS Management Console using their existing AD credentials. Which steps should you take to achieve this?
- A
Set up an AWS Identity and Access Management (IAM) role and assign a trust relationship to the organization's Active Directory.
- B
Configure AWS Single Sign-On (AWS SSO) and integrate it with your on-premises Active Directory using AWS Directory Service.
- C
Use Security Assertion Markup Language (SAML) to federate your on-premises Active Directory with AWS IAM roles.
- D
Manually create IAM users for each employee and assign permissions based on their roles in the Active Directory.
- E
Configure an identity provider (IdP) in AWS using the metadata file from your on-premises Active Directory Federation Services (AD FS).
Show answer and explanation
Correct answers: B, C, E
Explanation
To enable Single Sign-On (SSO) for AWS Management Console access using on-premises Active Directory credentials, you need to set up federated access. This involves using AWS Single Sign-On (AWS SSO) or configuring an identity provider (IdP) in AWS with SAML. AWS SSO can directly integrate with Active Directory via AWS Directory Service. Alternatively, you can use AD FS as the IdP and configure SAML-based federation with AWS IAM roles. Manual IAM user creation is not recommended for SSO, and IAM roles alone cannot establish trust with on-premises AD without federation or an IdP.
- A. Incorrect.
Incorrect: While IAM roles are essential for granting permissions, you cannot directly assign a trust relationship to an on-premises Active Directory, as it requires federation or integration with an identity provider.
- B. Correct.
Correct: AWS Single Sign-On (AWS SSO) can integrate with your on-premises Active Directory via AWS Directory Service to enable seamless authentication and authorization.
- C. Correct.
Correct: SAML is a standard protocol used to integrate AWS with Active Directory for federated access. SAML allows users to use their AD credentials to assume IAM roles.
- D. Incorrect.
Incorrect: Manually creating IAM users for each employee is not scalable or efficient for large organizations and does not achieve SSO.
- E. Correct.
Correct: Configuring an identity provider (IdP) in AWS with the metadata file from AD FS allows you to establish trust between AWS and your on-premises Active Directory for SAML-based federation.