DOP-C02 Question 360
Select 2Your organization uses an on-premises Active Directory (AD) to manage user identities. You have been tasked with enabling federated access to AWS for your employees while ensuring that permissions are based on their roles in the organization. The solution should minimize the need for managing individual user accounts in AWS. Which of the following steps would meet the requirement? (Select TWO.)
- A
Configure an IAM Identity Provider in AWS and integrate it with your on-premises Active Directory Federation Services (AD FS).
- B
Use AWS IAM Identity Center to synchronize your on-premises Active Directory users and groups directly into AWS IAM roles.
- C
Create an IAM role for each user in your organization and assign the role to the user in AWS.
- D
Configure SAML-based federation between your on-premises Active Directory Federation Services (AD FS) and AWS to enable role-based access.
- E
Manually create IAM users in AWS for each employee and assign appropriate permissions based on their roles.
Show answer and explanation
Correct answers: A, D
Explanation
The requirement is to enable federated access to AWS using existing on-premises Active Directory identities while minimizing user account management. Configuring an IAM Identity Provider and setting up SAML-based federation with AD FS achieves this by allowing employees to sign in with their existing credentials and granting access based on their roles. This avoids the need to create and manage individual IAM user accounts in AWS.
- A. Correct.
Correct: Configuring an IAM Identity Provider and integrating it with AD FS allows AWS to use SAML assertions from your on-premises Active Directory for federated access.
- B. Incorrect.
Incorrect: AWS IAM Identity Center does not directly synchronize on-premises Active Directory users and groups into IAM roles. It provides an alternative approach for managing identities but is not required in this scenario.
- C. Incorrect.
Incorrect: Creating a separate IAM role for each user would contradict the goal of minimizing individual user account management in AWS.
- D. Correct.
Correct: SAML-based federation enables single sign-on (SSO) and role-based access, aligning with the requirement to map permissions to roles while avoiding individual account management.
- E. Incorrect.
Incorrect: Manually creating IAM users for each employee increases administrative overhead and does not align with the goal of enabling federated access.