A company uses an organization in AWS Organizations to manage a multi-account landing zone. The company requires all users who access AWS accounts in the organization to use a centralized identity…

Question

Options

• AUse AWS Identity and Access Management (IAM) to create IAM users and IAM user groups in
• BCreate permission sets in AWS IAM Identity Center. Assign the appropriate permission sets to the
• CAssign each IAM user to an IAM role by using an inline IAM policy based on operational duties.
• DConfigure a SAML identity provider in AWS Identity and Access Management (IAM) in each AWS
• EEnable AWS IAM Identity Center in the organization management account. Create user accounts

• A
  12% (6)
• B
  56% (29)
• C
  25% (13)
• D
  8% (4)

Explanation

AWS recommends using AWS IAM Identity Center (formerly AWS SSO) for centralized authentication and access control across multiple accounts in an AWS Organization, especially when integrating with an external IdP. "Use IAM Identity Center to provide centralized access to multiple AWS accounts or applications. You can integrate with an external IdP via SAML 2.0. Assign users permissions through permission sets that define the roles users can assume." Why B and E are correct: E enables centralized identity federation using IAM Identity Center with your external IdP. B uses permission sets to apply least-privilege access roles to users and groups across accounts, in alignment with the principle of least privilege. Why others are incorrect: Option A: IAM users in each account break centralized access model and are hard to manage at Option C: Managing individual IAM roles and inline policies across accounts is not scalable. Option D: Per-account SAML providers are redundant when using IAM Identity Center, which provides centralized federation.

No community discussion yet for this question.