SAA-C03 Question 20
Single answerYour company uses an on-premises Active Directory (AD) for user authentication and is migrating workloads to AWS. The IT team wants to provide federated access to AWS Management Console and other AWS resources for users in the AD domain, without the need to manage individual IAM users in the AWS account. Which solution should you implement?
- A
Set up AWS IAM Identity Center (AWS Single Sign-On) and integrate it with your on-premises Active Directory using AWS Directory Service.
- B
Create individual IAM users for each AD user and configure their permissions manually.
- C
Deploy an AD Connector using AWS Directory Service and configure IAM roles for SAML-based federation.
- D
Use AWS Secrets Manager to store AD credentials and configure IAM policies to authenticate users.
Show answer and explanation
Correct answer: A
Explanation
AWS IAM Identity Center (AWS Single Sign-On) is the recommended service for enabling federated access to AWS resources for users in an on-premises Active Directory domain. It simplifies identity management by centralizing authentication and allowing users to access AWS resources without the need for individual IAM user accounts. This solution aligns with best practices and avoids manual, error-prone processes.
- A. Correct.
This is the correct solution. AWS IAM Identity Center (AWS Single Sign-On) allows you to integrate your on-premises Active Directory with AWS, enabling centralized federated access to AWS resources without creating individual IAM users.
- B. Incorrect.
Creating individual IAM users for each AD user is not scalable or efficient. It also does not meet the goal of federated access.
- C. Incorrect.
While AD Connector can facilitate integration between AWS and on-premises Active Directory, it does not directly support SAML-based federation for AWS Management Console access. AWS IAM Identity Center is the preferred solution for this use case.
- D. Incorrect.
AWS Secrets Manager is designed for securely storing and managing sensitive information like passwords, but it is not a solution for providing federated access or integrating with Active Directory.