A company uses AWS Organizations to manage its AWS accounts. A DevOps engineer must ensure that all users who access the AWS Management Console are authenticated through the company's corporate…

Question

Options

• AUse Amazon GuardDuty with a delegated administrator account Use GuardDuty to enforce denial
• BUse AWS IAM Identity Center to configure identity federation with SAML 2.0.
• CCreate a permissions boundary in AWS IAM Identity Center to deny password logins for IAM
• DCreate IAM groups in the Organizations management account to apply consistent permissions for
• ECreate an SCP in Organizations to deny password creation for IAM users.

• A
  13% (8)
• B
  75% (45)
• C
  8% (5)
• D
  3% (2)

Explanation

Explanation

Configuring AWS IAM Identity Center with SAML 2.0 (Option B) establishes the federated authentication bridge between the corporate IdP and AWS, ensuring all console access flows through the company's identity system rather than native AWS credentials. Pairing this with an SCP that denies IAM user password creation (Option E) enforces this at the organizational level, preventing any account from bypassing federation by creating local IAM users with console passwords - SCPs are the only guardrail that applies across all accounts in an Organization.

Why the distractors fail:

• A (GuardDuty): GuardDuty is a threat detection service, not an access control enforcement tool - it cannot deny authentication methods.
• C (Permissions boundary in IAM Identity Center): Permissions boundaries are an IAM concept, not an IAM Identity Center feature; this describes a non-existent capability and wouldn't enforce login method restrictions.
• D (IAM groups in management account): IAM groups in the management account don't propagate permissions to member accounts, and this approach still relies on IAM users rather than federation.

Memory Tip

Think "Bridge + Block": IAM Identity Center with SAML builds the federation bridge to your IdP, while the SCP blocks the back door (IAM password logins). You need both - one to enable federation, one to mandate it.

No community discussion yet for this question.