SAP-C02 Question 601
Single answerAn organization wants to centralize access management for multiple AWS accounts and applications, including third-party services. They require users to authenticate with their corporate Active Directory (AD) credentials. Additionally, they want to assign permissions to users based on their roles within the organization. Which AWS service or combination of services should you recommend?
- A
AWS IAM Identity Center (successor to AWS SSO)
- B
AWS Directory Service for Microsoft Active Directory
- C
Amazon Cognito
- D
AWS IAM Roles
Show answer and explanation
Correct answer: A
Explanation
AWS IAM Identity Center is the best solution because it enables centralized management of user access across multiple AWS accounts and applications, supports integration with corporate AD for authentication, and allows assigning permissions based on roles. While other services like AWS Directory Service or Amazon Cognito provide specific capabilities, they do not fulfill the organization's complete requirements for centralized access management and AD integration.
- A. Correct.
AWS IAM Identity Center (successor to AWS SSO) is the correct choice because it provides centralized access management for multiple AWS accounts and supports integration with corporate Active Directory (AD) for user authentication. It also allows assigning permissions based on roles.
- B. Incorrect.
AWS Directory Service for Microsoft Active Directory is used to set up a managed AD in AWS or integrate with an on-premises AD but does not directly provide centralized access management for multiple AWS accounts and applications.
- C. Incorrect.
Amazon Cognito is primarily used for user sign-up, sign-in, and access control for applications, but it is not designed for centralized management of multiple AWS accounts or integration with corporate AD.
- D. Incorrect.
AWS IAM Roles provide permissions for AWS services but do not address the need for centralized user access management or integration with corporate AD.