ANS-C01 Question 266
Select 3Your company is using an on-premises Active Directory (AD) for user authentication and plans to migrate its workloads to AWS. You are tasked with implementing an authentication mechanism for AWS Management Console access using existing AD credentials. Which of the following steps should you take to achieve this?
- A
Set up AWS Single Sign-On (SSO) and configure it to integrate with your on-premises Active Directory using AD Connector.
- B
Create an IAM user for each Active Directory user and manually assign permissions.
- C
Set up an Amazon Cognito user pool and synchronize it with your Active Directory.
- D
Configure a SAML 2.0 identity provider in AWS IAM and link it with your Active Directory Federation Services (AD FS).
- E
Use AWS Directory Service to establish a trust relationship with your on-premises Active Directory.
Show answer and explanation
Correct answers: A, D, E
Explanation
To provide AWS Management Console access using on-premises Active Directory credentials, you should use AWS services that support centralized authentication and integration with Active Directory. AWS Single Sign-On (SSO) with AD Connector, SAML 2.0 federation with AD FS, and AWS Directory Service trust relationships are all valid solutions. These approaches avoid the need for manually creating and managing IAM users and instead leverage existing AD infrastructure. Using Amazon Cognito is not suitable for this use case as it is designed for application authentication rather than AWS Management Console access.
- A. Correct.
Correct. AWS Single Sign-On (SSO) can integrate with on-premises Active Directory through AD Connector to provide centralized authentication for AWS resources.
- B. Incorrect.
Incorrect. Creating IAM users manually for each AD user would be inefficient and does not support centralized authentication using AD credentials.
- C. Incorrect.
Incorrect. Amazon Cognito is primarily used for application user authentication and not ideal for AWS Management Console access with AD credentials.
- D. Correct.
Correct. Configuring a SAML 2.0 identity provider in AWS IAM with AD FS enables federated authentication, allowing users to log in to the AWS Management Console using their AD credentials.
- E. Correct.
Correct. AWS Directory Service can establish a trust relationship with on-premises Active Directory, enabling seamless integration and authentication of AD users for AWS resources.