SAP-C02 Question 599
Single answerA company is building a multi-account AWS environment to centralize its user identities and permissions management across multiple accounts. They want to enable single sign-on (SSO) for their employees using their existing on-premises Microsoft Active Directory (AD) while ensuring that administrators can assign granular permissions to users across AWS accounts. Which solution would best meet these requirements?
- A
Use AWS IAM Identity Center (formerly AWS Single Sign-On) integrated with the on-premises Active Directory using AWS Directory Service for Microsoft Active Directory.
- B
Use AWS Directory Service Simple AD to synchronize the on-premises Active Directory and manage permissions using IAM roles in each account.
- C
Enable AWS Organizations and centrally manage permissions using Service Control Policies (SCPs) across all accounts.
- D
Deploy an EC2 instance running Active Directory Federation Services (AD FS) and configure SSO with SAML to access AWS accounts.
Show answer and explanation
Correct answer: A
Explanation
AWS IAM Identity Center (formerly AWS Single Sign-On) integrated with AWS Directory Service for Microsoft AD is the recommended solution for enabling SSO with an on-premises Active Directory. This setup allows for centralized identity management, seamless integration with existing directories, and granular permissions management across AWS accounts without the need for complex self-managed solutions like AD FS.
- A. Correct.
Correct. AWS IAM Identity Center integrates seamlessly with AWS Directory Service for Microsoft AD, allowing you to connect your on-premises directory for SSO and manage granular permissions centrally across AWS accounts.
- B. Incorrect.
Incorrect. AWS Directory Service Simple AD does not support integration with on-premises Active Directory, and it cannot be used for centralized permissions management across AWS accounts.
- C. Incorrect.
Incorrect. While AWS Organizations can be used to manage accounts and apply SCPs, SCPs are not a substitute for user identity or SSO solutions and do not provide granular user permissions management.
- D. Incorrect.
Incorrect. Deploying AD FS on an EC2 instance is a valid approach for SSO, but it adds unnecessary complexity and management overhead compared to the fully managed AWS IAM Identity Center solution.