SAP-C02 Question 55
Single answerYour organization has implemented AWS IAM Identity Center (AWS Single Sign-On) to centralize access management for multiple AWS accounts in your organization. The team managing the accounts requires an architecture where users are automatically assigned permissions based on their roles in the corporate directory. Additionally, any changes to the roles in the directory should reflect automatically in AWS. How can you achieve this setup?
- A
Integrate AWS IAM Identity Center with your corporate directory using SAML 2.0 and configure permission sets in IAM Identity Center.
- B
Manually assign IAM roles to users in IAM Identity Center after integrating it with the corporate directory.
- C
Integrate AWS IAM Identity Center with your corporate directory and use SCIM (System for Cross-domain Identity Management) to synchronize group memberships.
- D
Use AWS Organizations to manage user permissions directly across accounts.
Show answer and explanation
Correct answer: C
Explanation
To achieve automated assignment of permissions based on corporate directory roles and reflect changes dynamically, you need to integrate AWS IAM Identity Center with the corporate directory and use SCIM for synchronization. SCIM allows you to automatically synchronize user and group memberships from the corporate directory to AWS, ensuring a seamless and automated permissions management process.
- A. Incorrect.
This option is incorrect because while SAML 2.0 enables single sign-on, it does not provide automatic synchronization of group memberships or permission assignments.
- B. Incorrect.
This option is incorrect because manually assigning roles is not automated and does not reflect role changes in the corporate directory.
- C. Correct.
This option is correct because integrating AWS IAM Identity Center with the corporate directory and using SCIM ensures that group memberships and role changes in the corporate directory are automatically synchronized with AWS.
- D. Incorrect.
This option is incorrect because AWS Organizations manages accounts and policies at an account level, not user-level permissions or role synchronization directly.