CLF-C02 Question 116
Single answerYour company uses an on-premises Active Directory (AD) for managing user identities. You want to provide your employees with seamless single sign-on (SSO) access to AWS resources without creating separate IAM users for each employee. Which identity management approach should you use?
- A
Federated identity management using AWS IAM roles and SAML
- B
AWS Organizations to manage user identities across accounts
- C
Creating individual IAM users for each employee in the AWS Management Console
- D
Using Amazon Cognito for employee identity and access management
Show answer and explanation
Correct answer: A
Explanation
To enable seamless single sign-on (SSO) access to AWS resources while using an on-premises Active Directory (AD), federated identity management with AWS IAM roles and SAML is the appropriate solution. This allows you to integrate your existing identity provider with AWS, avoiding the need to create individual IAM users.
- A. Correct.
Federated identity management using AWS IAM roles and SAML allows you to integrate AWS with on-premises Active Directory (AD) or other identity providers. This enables single sign-on (SSO) for your employees.
- B. Incorrect.
AWS Organizations is used for managing multiple AWS accounts but does not handle identity federation or single sign-on (SSO).
- C. Incorrect.
Creating individual IAM users for each employee is not scalable and does not provide single sign-on (SSO).
- D. Incorrect.
Amazon Cognito is primarily designed for managing customer identities for applications, not for integrating with on-premises Active Directory for employee SSO.