SCS-C02 Question 290
Single answerA company wants to enable single sign-on (SSO) for their employees to access multiple AWS accounts and third-party applications. They also want to integrate with their existing on-premises Active Directory for authentication. Which AWS service or combination of services should the company use to achieve this?
- A
AWS IAM Identity Center (AWS Single Sign-On)
- B
Amazon Cognito with Active Directory integration
- C
AWS Directory Service and AWS IAM Identity Center (AWS Single Sign-On)
- D
AWS Identity and Access Management (IAM) with manually created user accounts
Show answer and explanation
Correct answer: C
Explanation
To enable SSO for multiple AWS accounts and third-party applications while integrating with an on-premises Active Directory, the company needs to use AWS Directory Service to establish a connection to their on-premises Active Directory. AWS IAM Identity Center (AWS Single Sign-On) can then be used to provide SSO functionality. This combination meets all the requirements of the scenario, including Active Directory integration, SSO for AWS accounts, and support for third-party applications.
- A. Incorrect.
AWS IAM Identity Center (AWS Single Sign-On) supports SSO for multiple AWS accounts and third-party applications, but it requires integration with AWS Directory Service to authenticate against on-premises Active Directory.
- B. Incorrect.
Amazon Cognito is typically used for customer-facing applications and does not natively provide SSO for AWS accounts or third-party applications integrated with Active Directory.
- C. Correct.
AWS Directory Service can integrate with on-premises Active Directory, and AWS IAM Identity Center (AWS Single Sign-On) provides SSO capabilities. Together, they allow the company to meet the requirements of both Active Directory integration and access to AWS and third-party applications.
- D. Incorrect.
AWS Identity and Access Management (IAM) with manually created user accounts does not support SSO or integration with external identity providers such as Active Directory, making it unsuitable for this use case.