Q35 — AWS SAA-C03 Ch.13

Question 35 of 100 | ← Chapter 13

Q935. A company needs to give a globally distributed development team secure access to the company's AWS resources in a way that complies with security policies.The company currently uses an on-premises Active Directory for internal authentication.The company uses AWS Organizations to manage multiple AWS accounts that support multiple projects.The company needs a solution to integrate with the existing infrastructure to provide centralized identity management and access control.Which solution will meet these requirements with the LEAST operational overhead?

• A. Set up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS.Establish a trust relationship with the on-premises Active Directory. Use IAM roles that are assigned to Active Directory groups to access AWS resources within the company's AWS accounts.
• B. Create an IAM user for each developer.Manually manage permissions for each IAM user based on each user's involvement with each project.Enforce multi-factor authentication(MFA) as an additional layer of security.
• C. Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS accounts and resources. ✓
• D. Use Amazon Cognito to deploy an identity federation solution. Integrate the identity federation solution with the on-premises Active Directory. Use Amazon Cognito to provide access tokens for developers to access AWS accounts and resources

Correct Answer: C. Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS accounts and resources.

Explanation

The solution that meets the requirements with the LEAST operational overhead is:C. Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS accounts and resources.Here's why:Centralized Identity Management: AD Connector allows you to connect your on-premises Active Directory to AWS Directory Service, enabling centralized identity management for both on-premises and cloud resources.Integration with IAM Identity Center: Integrating AD Connector with IAM Identity Center (formerly AWS SSO) provides a unified platform for managing user access across multiple AWS accounts.Permissions Sets: IAM Identity Center allows you to define permissions sets that grant specific access levels to AWS resources based on Active Directory groups. This simplifies permission management and ensures compliance with security policies.Reduced Operational Overhead: This approach minimizes manual configuration and management of individual user permissions, reducing operational overhead and simplifying access control.Why other options are less efficient or require more effort:A. Set up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS. Establish a trust relationship with the on-premises Active Directory. Use IAM roles that are assigned to Active Directory groups to access AWS resources within the company's AWS accounts. While this approach provides integration with Active Directory, it involves managing a separate AWS-managed directory, adding complexity and potential overhead.B. Create an IAM user for each developer.Manually manage permissions for each IAM user based on each user's involvement with each project.Enforce multi-factor authentication(MFA) as an additional layer of security. This approach requires manual configuration and management of individual user permissions, leading to significant operational overhead and potential for errors.D. Use Amazon Cognito to deploy an identity federation solution. Integrate the identity federation solution with the on-premises Active Directory. Use Amazon Cognito to provide access tokens for developers to access AWS accounts and resources. While Cognito offers identity federation, it's primarily designed for user authentication and authorization in web and mobile applications, not for managing access to AWS resources across multiple accounts.In summary:Option C provides the most efficient and scalable solution for managing access to AWS resources for a globally distributed development team. It leverages existing infrastructure, simplifies permission management, and reduces operational overhead.