SAA-C03 Question 19
Single answerA company wants to provide its employees with secure, seamless access to the AWS Management Console and multiple AWS accounts using their existing corporate credentials. The IT team wants to minimize the need for managing IAM users and passwords in AWS. Which solution should the company implement to achieve this?
- A
Configure AWS IAM Identity Center (AWS Single Sign-On) to integrate with the company's existing identity provider (IdP) using SAML 2.0.
- B
Create IAM users for each employee in every AWS account and assign them appropriate permissions.
- C
Set up an AWS Lambda function to authenticate users against the company's corporate directory and grant temporary access to AWS resources.
- D
Use IAM roles with an external identity provider (IdP) to enable federated access to AWS accounts.
Show answer and explanation
Correct answer: A
Explanation
AWS IAM Identity Center (AWS Single Sign-On) is the recommended service for providing federated access to AWS accounts using corporate credentials. It simplifies identity management by integrating with existing IdPs through SAML 2.0 and eliminates the need for creating and managing individual IAM users and passwords.
- A. Correct.
This is the correct option. AWS IAM Identity Center (AWS Single Sign-On) is designed for providing centralized access to multiple AWS accounts and applications using corporate credentials. It supports integration with existing IdPs using SAML 2.0, which minimizes the need to manage IAM users and passwords in AWS.
- B. Incorrect.
This option is incorrect because creating IAM users for each employee in every AWS account would increase administrative overhead and contradict the goal of minimizing user management in AWS.
- C. Incorrect.
This option is incorrect because AWS Lambda is not designed for user authentication workflows. While it could potentially be used in a custom solution, it would be overly complex and not an AWS-recommended approach for federated access.
- D. Incorrect.
This option is incorrect because while IAM roles with an external IdP can provide federated access, it does not offer the centralized management and seamless experience across multiple AWS accounts that AWS IAM Identity Center provides.