DOP-C02 Question 359
Single answerYour organization has a workforce that uses a centralized identity provider (IdP) such as Active Directory Federation Services (AD FS) to manage employee authentication. You are tasked with configuring AWS account access for the workforce so that users can seamlessly access AWS Management Console and CLI using their existing corporate credentials. Security compliance also mandates that access to specific AWS accounts and roles must be restricted based on user groups defined in the IdP. Which approach should you implement to fulfill these requirements?
- A
Configure AWS IAM Identity Center (AWS Single Sign-On) to integrate with the corporate IdP and assign permissions to users based on their group membership.
- B
Create IAM users for each employee in AWS and assign IAM policies based on their corporate group membership.
- C
Set up an IAM identity provider for the corporate IdP and configure IAM roles with permissions tied to IdP SAML assertions for group-based access control.
- D
Use AWS Organizations to directly synchronize user accounts and group memberships from the corporate IdP.
Show answer and explanation
Correct answer: A
Explanation
AWS IAM Identity Center (AWS SSO) is the preferred solution for integrating with a centralized identity provider like AD FS. It simplifies user access management by allowing seamless access to the AWS Management Console and CLI while mapping permissions to users or groups based on their corporate credentials. This approach minimizes complexity and adheres to security compliance by leveraging group-based access control within the IdP.
- A. Correct.
This is the correct approach. AWS IAM Identity Center (AWS SSO) supports integration with external identity providers using SAML 2.0 or other federation protocols. It allows you to assign AWS account and role permissions to users based on their group membership in the IdP.
- B. Incorrect.
This approach is incorrect because manually creating IAM users for each employee is not scalable and violates the principle of centralized identity management. It also does not leverage the existing corporate IdP for federation.
- C. Incorrect.
While setting up an IAM identity provider and configuring IAM roles for SAML assertions is feasible, it is a more complex and manual approach compared to using AWS IAM Identity Center, which offers streamlined integration and management.
- D. Incorrect.
AWS Organizations does not provide direct synchronization of user accounts or group memberships from external IdPs. Its primary purpose is to manage multiple AWS accounts and apply service control policies (SCPs).