DVA-C02 Question 127
Single answerA company is building a web application that allows users to log in using their existing corporate credentials managed in an on-premises Active Directory. The application is hosted on AWS. The development team wants to avoid creating and maintaining separate user accounts for these employees in the application. Which approach should the team take to implement this solution?
- A
Configure an Amazon Cognito user pool and set up federation with the corporate Active Directory using SAML.
- B
Create IAM users for all employees and provide them with access to the application.
- C
Use Amazon Cognito identity pools to directly connect to the on-premises Active Directory.
- D
Set up an OpenID Connect (OIDC) provider in AWS IAM and map the corporate Active Directory users to IAM roles.
Show answer and explanation
Correct answer: A
Explanation
To integrate an on-premises Active Directory with an AWS-hosted application, the most effective approach is to use Amazon Cognito user pools with SAML-based federation. This allows users to authenticate using their corporate credentials without creating duplicate accounts in the application.
- A. Correct.
This is the correct approach. Amazon Cognito user pools support SAML-based identity federation. This allows the application to integrate with the corporate Active Directory without creating separate user accounts.
- B. Incorrect.
This is not a scalable or recommended solution, as it requires manually creating and managing IAM users for all employees.
- C. Incorrect.
Amazon Cognito identity pools are used for granting temporary AWS credentials, not for direct integration with Active Directory. Federation with Active Directory requires user pools and SAML.
- D. Incorrect.
While OIDC is a valid protocol, it is not suitable for integrating with on-premises Active Directory in this scenario. SAML is the more appropriate choice.