Q95 — AWS SAA-C03 Ch.10

Question 95 of 100 | ← Chapter 10

Q695. A company sets up an organization in AWS Organizations that contains 10 AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees. The company has an existing identity provider (IdP). The company wants to use the existing IdP for authentication to AWS.Which solution will meet these requirements?Note: AWS certification is more difficult for non-technical personnel, each question needs to spend several minutes to read, reading consumes a lot of time and energy, thus affecting their work, if non-technical personnel have a need for exam shortcuts contact wechat: ANYPASS, we will help you to easily pass (and of course if the technical staff need to contact.

• A. Create IAM users for the employees in the required AWS accounts. Connect IAM users to the existing IdP. Configure federated authentication for the IAM users
• B. Set up AWS account root users with user email addresses and passwords that are synchronized from the existing IdP
• C. Configure AWS IAM Identity Center (AWS Single Sign-On). Connect IAM Identity Center to the existing IdP. Provision users and groups from the existing IdP ✓
• D. Use AWS Resource Access Manager (AWS RAM) to share access to the AWS accounts with the users in the existing IdP

Correct Answer: C. Configure AWS IAM Identity Center (AWS Single Sign-On). Connect IAM Identity Center to the existing IdP. Provision users and groups from the existing IdP

Explanation

To meet the requirements of providing access to multiple AWS accounts for several thousand employees using an existing identity provider (IdP) for authentication to AWS, the following solution should be implemented:C. Configure AWS IAM Identity Center (AWS Single Sign-On). Connect IAM Identity Center to the existing IdP. Provision users and groups from the existing IdP.Option C provides a centralized and scalable solution for managing access to multiple AWS accounts using an existing IdP:- Configure AWS IAM Identity Center (AWS Single Sign-On): AWS Single Sign-On (SSO) provides a unified identity management solution for AWS accounts. It allows you to configure and manage users, groups, and permissions centrally.- Connect IAM Identity Center to the existing IdP: AWS SSO supports integration with external identity providers, including SAML 2.0-based IdPs. By connecting AWS SSO to the existing IdP, you can leverage the existing authentication infrastructure for accessing AWS accounts.- Provision users and groups from the existing IdP: AWS SSO allows you to provision users and groups from the existing IdP into AWS SSO. This eliminates the need to manually create IAM users and manage their access in each AWS account. Users and groups can be assigned permissions and granted access to the required AWS accounts.Option A, creating IAM users for employees in the required AWS accounts and configuring federated authentication, requires managing IAM users individually in each AWS account, which is not scalable and can lead to operational overhead.Option B, setting up AWS account root users with synchronized email addresses and passwords from the existing IdP, is not recommended for security and manageability reasons. Managing access through root users is not a best practice.Option D, using AWS Resource Access Manager (AWS RAM) to share access to AWS accounts with users in the existing IdP, does not provide a centralized identity management solution. AWS RAM is used for sharing resources across accounts, not for managing user authentication and access.Therefore, the best solution is C: Configure AWS IAM Identity Center (AWS Single Sign-On), connect IAM Identity Center to the existing IdP, and provision users and groups from the existing IdP. This solution provides a scalable and centralized approach for managing access to multiple AWS accounts using the existing IdP for authentication.