Q88 — AWS SAA-C03 Ch.10

Question 88 of 100 | ← Chapter 10

Q688. A company needs to use its on-premises LDAP directory service to authenticate its users to the AWS Management Console. The directory service is not compatible with Security Assertion Markup Language (SAML).Which solution meets these requirements?

Correct Answer: D. Develop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials

Explanation

The solution that meets the requirements of using the on-premises LDAP directory service to authenticate users to the AWS Management Console, even if the directory service is not compatible with SAML, is:D. Develop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials.Option D suggests developing an on-premises custom identity broker application or process that utilizes AWS STS to obtain short-lived credentials. This approach allows you to bridge the gap between the on- premises LDAP directory service and AWS IAM. The custom identity broker application or process would handle the authentication of users against the LDAP directory service and then use AWS STS to exchange the LDAP credentials for temporary AWS credentials. These temporary credentials can then be used to authenticate the users to the AWS Management Console.Option A, enabling AWS IAM Identity Center (AWS Single Sign-On) between AWS and the on-premises LDAP, is not applicable in this scenario because the on-premises LDAP directory service is not compatible with SAML, which is a requirement for using AWS Single Sign-On.Option B, creating an IAM policy that uses AWS credentials and integrating the policy into LDAP, is not a suitable solution in this case because the IAM policy is not directly related to authenticating users to the AWS Management Console using the on-premises LDAP directory service.Option C, setting up a process that rotates the IAM credentials whenever LDAP credentials are updated, is not a recommended solution as it does not address the requirement of authenticating users to the AWS Management Console using the on-premises LDAP directory service. IAM credentials rotation is a separate security best practice that focuses on regularly changing IAM user credentials to enhance security.Therefore, the most appropriate solution is D: Develop an on-premises custom identity broker application or process that uses AWS STS to obtain short-lived credentials. This approach provides a way to leverage the existing LDAP directory service for user authentication while enabling access to the AWS Management Console using temporary AWS credentials obtained through AWS STS.