DOP-C02 · Question #147
A company manually provisions IAM access for its employees. The company wants to replace the manual process with an automated process. The company has an existing Active Directory system configured…
The correct answer is A. Configure an external IdP as an identity source. Configure automatic provisioning of users and groups. AWS SSO (Single Sign-On) integrates with external identity providers using SAML 2.0, and it can automatically synchronize users and groups from a connected directory using the SCIM (System for Cross-domain Identity Management) protocol. Thus, the DevOps engineer should…
Question
A company manually provisions IAM access for its employees. The company wants to replace the manual process with an automated process. The company has an existing Active Directory system configured with an external SAML 2.0 identity provider (IdP). The company wants employees to use their existing corporate credentials to access AWS. The groups from the existing Active Directory system must be available for permission management in AWS Identity and Access Management (IAM). A DevOps engineer has completed the initial configuration of AWS IAM Identity Center (AWS Single Sign-On) in the company's AWS account. What should the DevOps engineer do next to meet the requirements?
Options
- AConfigure an external IdP as an identity source. Configure automatic provisioning of users and groups
- BConfigure AWS Directory Service as an identity source. Configure automatic provisioning of users and
- CConfigure an AD Connector as an identity source. Configure automatic provisioning of users and
- DConfigure an external IdP as an identity source Configure automatic provisioning of users and groups
How the community answered
(50 responses)- A80% (40)
- B12% (6)
- C6% (3)
- D2% (1)
Explanation
AWS SSO (Single Sign-On) integrates with external identity providers using SAML 2.0, and it can automatically synchronize users and groups from a connected directory using the SCIM (System for Cross-domain Identity Management) protocol. Thus, the DevOps engineer should configure the external IdP as an identity source and then configure automatic provisioning of users and groups by using the SCIM protocol. This will ensure the groups from the existing Active Directory system are available for permission management in AWS Identity and Access Management (IAM) and that employees can use their existing corporate credentials to access AWS.
Topics
Community Discussion
No community discussion yet for this question.