A company sets up an organization in AWS Organizations that contains 10AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees…

Question

Options

• ACreate IAM users for the employees in the required AWS accounts. Connect IAM users to the
• BSet up AWS account root users with user email addresses and passwords that are synchronized
• CConfigure AWS IAM Identity Center Connect IAM Identity Center to the existing IdP Provision
• DUse AWS Resource Access Manager (AWS RAM) to share access to the AWS accounts with the

• A
  4% (1)
• C
  93% (26)
• D
  4% (1)

Explanation

AWS IAM Identity Center: IAM Identity Centerprovides centralized access management for multiple AWS accounts within an organization and integrates seamlessly with existing identity providers (IdPs) throughSAML 2.0 It allows users to authenticate using their existing IdP credentials and gain access to AWS resources without the need to create and manage separate IAM users in each account. IAM Identity Centeralso simplifies provisioning and de-provisioning users, as it can automatically synchronize users and groups from the external IdP to AWS, ensuring secure and managed Integration with Existing IdP: The solution involves configuringIAM Identity Centerto connect to the company's IdP using SAML. This setup allows employees to log in with their existing credentials, reducing the complexity of managing separate AWS credentials. Once connected,IAM Identity Centerhandles authentication and authorization, granting users access to the AWS accounts based on their assigned roles and permissions. Why the Other Options Are Incorrect: Option A: Creating separateIAM usersfor each employee is not scalable or efficient. Managing thousands of IAM users across multiple AWS accounts introduces unnecessary complexity and operational overhead. Option B: Using AWSroot userswith synchronized passwords is a security risk and goes against AWS best practices. Root accounts should never be used for day-to-day operations. Option D: AWS Resource Access Manager (RAM)is used for sharing AWS resources between accounts, not for federating access for users across accounts. It doesn't provide a solution for authentication via an external IdP.

No community discussion yet for this question.