Q100 — AWS SAA-C03 Ch.15

Question 100 of 100 | ← Chapter 15

Q1200. A company uses AWS Organizations.The company has more than 100 AWS accounts and will increase the number of accounts. The company also uses an external corporate identity provider (ldP).The company needs to provide users with role-based access to the accounts.The solution must maximize scalability and operational efficiency.Which solution will meet these requirements?

• A. In each account,create a set of dedicated IAM users.Ensure that all users assume these IAM users through federation with the existing ldP.
• B. Deploy an IAM role in a central identity account. Allow users to assume the role through federation with the existing ldP. ln each account, deploy a set of IAM roles that match the desired access patterns.Include a trust policy that allows access from the central identity account. Edit the permissions policy for the role in each account to match user access requirements.
• C. Enable AWS IAM Identity Center.Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements. ✓
• D. In each account, deploy a set of IAM roles that match the desired access patterns. Create a trust policy with the existing IdP. Update each role's permissions policy to use SAML-based IAM condition keys that are based on user access requirements.

Correct Answer: C. Enable AWS IAM Identity Center.Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements.

Explanation

To meet the requirements of providing users with role-based access to more than 100 AWS accounts while maximizing scalability and operational efficiency, the most suitable solution is:C. Enable AWS IAM Identity Center. Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements.Analysis:AWS IAM Identity Center (formerly AWS Single Sign-On): IAM Identity Center is a cloud-based identity and access management service that makes it easy to centrally manage access to AWS accounts and business applications. It provides a single place to manage user access to multiple AWS accounts and business applications, making it highly scalable and operationally efficient for organizations with a large number of AWS accounts.Integration with External IdP: IAM Identity Center can be integrated with an external corporate identity provider (IdP), such as Active Directory Federation Services (AD FS), Okta, or Ping Identity. This allows users to sign in using their existing corporate credentials, simplifying the authentication process and reducing the need for managing multiple sets of credentials. Role-Based Access Control: IAM Identity Center allows you to create permission sets that define the access policies for users. These permission sets can be assigned to users or groups, providing role-based access control across all AWS accounts. This makes it easy to manage and enforce consistent access policies across the organization.Scalability and Operational Efficiency: With IAM Identity Center, you can manage user access to all AWS accounts from a single console. This reduces the operational overhead associated with managing IAM users and roles in each individual AWS account. Additionally, IAM Identity Center automatically scales to support a large number of users and AWS accounts, making it a highly scalable solution.Why the Other Options Are Not Suitable:A. In each account, create a set of dedicated IAM users. Ensure that all users assume these IAM users through federation with the existing IdP.Why Not: This solution involves creating IAM users in each AWS account, which can be time-consuming and difficult to manage, especially with a large number of accounts. Additionally, it does not provide the same level of scalability and operational efficiency as IAM Identity Center. B. Deploy an IAM role in a central identity account. Allow users to assume the role through federation with the existing IdP. In each account, deploy a set of IAM roles that match the desired access patterns. Include a trust policy that allows access from the central identity account. Edit the permissions policy for the role in each account to match user access requirements.Why Not: While this solution provides some level of centralization and role-based access control, it still involves managing IAM roles in each AWS account. This can be complex and time-consuming, especially with a large number of accounts. Additionally, it does not provide the same level of scalability and ease of management as IAM Identity Center.D. In each account, deploy a set of IAM roles that match the desired access patterns. Create a trust policy with the existing IdP. Update each role's permissions policy to use SAML-based IAM condition keys that are based on user access requirements.Why Not: Similar to option B, this solution involves managing IAM roles in each AWS account, which can be complex and time-consuming. Additionally, using SAML-based IAM condition keys requires careful configuration and management, which can increase operational overhead. IAM Identity Center provides a more streamlined and scalable solution for managing user access across multiple AWS accounts.Conclusion:Enabling AWS IAM Identity Center and integrating it with the company's existing IdP provides a scalable, operationally efficient, and role-based access control solution for managing user access to more than 100 AWS accounts.