SAP-C02 Question 53
Single answerA company is migrating its workforce to a centralized identity management solution using AWS IAM Identity Center (AWS Single Sign-On). The company wants to assign users permissions to access AWS accounts based on their job roles and ensure that permissions are automatically updated if a user’s role changes in the directory. Additionally, they require the solution to integrate with their existing Microsoft Active Directory (AD). Which solution meets these requirements?
- A
Enable AWS IAM Identity Center and configure it to use Microsoft Active Directory as an identity source via AD Connector. Use permission sets to assign role-based access to AWS accounts.
- B
Enable AWS IAM Identity Center and configure it to use an external SAML 2.0 identity provider for authentication. Assign IAM policies directly to users to control access to AWS accounts.
- C
Use AWS IAM roles with inline policies to grant permissions and configure an external SAML 2.0 identity provider for authentication.
- D
Use AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) and configure trust relationships with your on-premises Microsoft Active Directory. Assign IAM roles to users directly based on their directory roles.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use AWS IAM Identity Center configured with Microsoft Active Directory via AD Connector as the identity source. This setup allows the company to manage user access based on AD group membership and use permission sets for role-based access to AWS accounts. Changes in AD group membership automatically reflect in AWS permissions, ensuring compliance with the requirement for automated updates. Other options either do not meet the automation requirement or do not align with best practices for centralized identity management.
- A. Correct.
This is correct. AWS IAM Identity Center can integrate with Microsoft Active Directory through AD Connector to use AD as the identity source. Permission sets allow role-based access to AWS accounts, and changes in AD group membership automatically update access permissions.
- B. Incorrect.
This is incorrect. While AWS IAM Identity Center supports external SAML 2.0 identity providers, assigning IAM policies directly to users is not recommended as it does not scale well and does not align with the company's requirement for automated permission updates.
- C. Incorrect.
This is incorrect. Using AWS IAM roles with inline policies and an external SAML 2.0 provider doesn't provide centralized role-based management or automated updates based on directory changes.
- D. Incorrect.
This is incorrect. While AWS Managed Microsoft AD can be used for directory services, assigning IAM roles directly to users is not scalable and does not meet the requirement for centralized role-based management or automatic permission updates.