SAA-C03 Question 17
Single answerA company wants to provide its employees federated access to AWS resources using their existing corporate credentials. The company uses Microsoft Active Directory as its identity provider (IdP). They want to manage access centrally and ensure that employees can log in to the AWS Management Console without creating individual IAM users. Which solution will best meet these requirements?
- A
Set up AWS IAM Identity Center (AWS Single Sign-On) and integrate it with the corporate Active Directory using AWS Directory Service.
- B
Create individual IAM users for each employee and configure password policies to match corporate standards.
- C
Use AWS Cognito to federate access between Microsoft Active Directory and AWS services.
- D
Enable AWS IAM Federation and manually configure Active Directory to issue SAML assertions to AWS.
Show answer and explanation
Correct answer: A
Explanation
The best solution for federated access to AWS resources using corporate credentials is AWS IAM Identity Center (AWS Single Sign-On). It provides centralized access management and integrates easily with Microsoft Active Directory using AWS Directory Service. This setup allows employees to use their existing credentials to log in to the AWS Management Console without creating individual IAM users, meeting the company's requirements efficiently.
- A. Correct.
This is the correct solution. AWS IAM Identity Center (AWS Single Sign-On) allows integration with Microsoft Active Directory via AWS Directory Service, enabling federated access and centralized access management.
- B. Incorrect.
This is not a suitable solution. Creating individual IAM users for each employee does not leverage federation and central management of access.
- C. Incorrect.
AWS Cognito is primarily used for handling authentication for web and mobile applications but is not designed for federating access for AWS Management Console or AWS services directly with Active Directory.
- D. Incorrect.
While AWS IAM Federation supports SAML-based authentication, manually configuring Active Directory to issue SAML assertions is complex and not the best practice when AWS IAM Identity Center is available for seamless integration.