A company needs to give a globally distributed development team secure access to the company's AWS resources in a way that complies with security policies. The company currently uses an on-premises Ac

Question

Options

• ASet up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS.
• BCreate an IAM user for each developer. Manually manage permissions for each IAM user based
• CUse AD Connector in AWS Directory Service to connect to the on-premises Active Directory.
• DUse Amazon Cognito to deploy an identity federation solution. Integrate the identity federation

• A
  4% (1)
• B
  7% (2)
• C
  75% (21)
• D
  14% (4)

Explanation

UsingAD ConnectorwithAWS IAM Identity Center(formerly AWS Single Sign-On) allows the company to leverage its existingon-premises Active Directoryfor centralized identity management and access control. AD Connector acts as a proxy to the on-premises AD withoutrequiring additional infrastructure or complex setup. This solution integrates seamlessly with AWS, allowing the development team to use their existing AD credentials to access AWS resources across multiple accounts managed by AWS Organizations. The permissions for AWS resources can be managed centrally through IAM Identity Center by configuring permission sets. This solution provides: Least operational overhead: AD Connector is fully managed, and IAM Identity Center allows centralized management of permissions across accounts. Secure access: The solution complies with security policies by using existing AD authentication Option A (AWS Managed AD): Setting up a fully managed AWS AD and establishing a trust is more complex and involves additional operational overhead. Option B (IAM Users): Manually managing IAM users and permissions is less scalable and increases operational complexity. Option D (Cognito): Amazon Cognito is more suited for user-facing applications rather than internal identity management for AWS resources.

No community discussion yet for this question.