SAA-C03 · Question #484
A multinational company operates in multiple AWS Regions. The company must ensure that its developers and administrators have secure, role-based access to AWS resources. The roles must be specific…
The correct answer is B. Configure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the. IAM Identity Center (formerly AWS SSO) is designed for: Federated access from external directories (e.g., Active Directory, Okta) Centralized permission management Granular control via Attribute-based access control (ABAC) "IAM Identity Center allows you to manage SSO access to…
Question
A multinational company operates in multiple AWS Regions. The company must ensure that its developers and administrators have secure, role-based access to AWS resources. The roles must be specific to each user's geographic location and job responsibilities. The company wants to implement a solution to ensure that each team can access only resources within the team's Region. The company wants to use its existing directory service to manage user access. The existing directory service organizes users into roles based on location. The system must be capable of integrating seamlessly with multi-factor authentication (MFA). Which solution will meet these requirements?
Options
- AUse AWS Security Token Service (AWS STS) to generate temporary access tokens. Integrate
- BConfigure AWS IAM Identity Center with federated access. Integrate IAM Identity Center with the
- CCreate IAM managed policies that restrict access by location. Apply policies based on group
- DUse custom Lambda functions to dynamically assign IAM policies based on login location and job
How the community answered
(39 responses)- A13% (5)
- B77% (30)
- C3% (1)
- D8% (3)
Explanation
IAM Identity Center (formerly AWS SSO) is designed for: Federated access from external directories (e.g., Active Directory, Okta) Centralized permission management Granular control via Attribute-based access control (ABAC) "IAM Identity Center allows you to manage SSO access to AWS accounts and business applications centrally. You can assign users and groups permissions based on directory attributes such as Region and job role." This option ensures: Federated, centralized access Region-specific permissions MFA and role mapping via existing directory service
Community Discussion
No community discussion yet for this question.