Q80 — AWS SAA-C03 Ch.17

Question 80 of 89 | ← Chapter 17

Q1380. A company is using an Active Directory based Identity service that supports SAML 2.0. The company wants to use the existing authentication solution to access the AWS Management Console. A solutions architect needs to configure federated authentication.Which solution will meet these requirements?

Correct Answer: D. Configure AWS IAM Identity Center to use an external IdP. Provide the SAML metadata from the identity provider.

Explanation

Let's analyze each option to determine which one meets the requirement of using an existing Active Directory - based Identity service that supports SAML 2.0 for federated authentication to access the AWS Management Console:Option AAWS Verified Access: AWS Verified Access is designed to provide secure access to applications running in AWS without the need for traditional VPNs. It is mainly focused on granting access to applications based on various conditions like device posture, user identity, etc. However, it is not the primary service for setting up federated authentication with an existing Active Directory Identity Provider (IdP) for accessing the AWS Management Console. Creating a new trust provider in Verified Access and connecting the Active Directory IdP is not the standard way to achieve this goal. So, this option is incorrect.Option BAmazon Cognito: Amazon Cognito is mainly used for handling user authentication and authorization for web and mobile applications. It has two main components: user pools for user management and identity pools for granting access to AWS resources. While it can integrate with external IdPs, the process described here is more complex than necessary for simply enabling federated access to the AWS Management Console. Also, the focus of Cognito is more on application - level authentication rather than direct console access federation. So, this option is incorrect.Option CAWS Amplify: AWS Amplify is a set of tools and services for building scalable web and mobile applications. Using Amplify Auth to configure a custom authentication backend and setting up an EC2 instance with a Node.js application to link AWS IAM Identity Center (formerly AWS Single Sign - On) with on - premises Active Directory through LDAP is an overly complex and non - standard approach. There are more straightforward ways to achieve federated authentication for the AWS Management Console. So, this option is incorrect.Option DAWS IAM Identity Center: AWS IAM Identity Center (formerly AWS Single Sign - On) is a service that enables single sign - on (SSO) access to AWS accounts and business applications. It supports integration with external IdPs that support SAML 2.0, such as Active Directory. By configuring AWS IAM Identity Center to use an external IdP and providing the SAML metadata from the identity provider, the company can enable its users to authenticate using the existing Active Directory credentials and gain access to the AWS Management Console. This is the correct and standard way to achieve the requirement. So, this option is correct.Therefore, the solution that will meet the requirements is Option D.