SAP-C02 · Question #528
A company has many separate AWS accounts and uses no central billing or management. Each AWS account hosts services for different departments in the company. The company has a Microsoft Azure Active…
The correct answer is A. Create a new AWS account to serve as a management account. Deploy an organization in AWS C. Deploy AWS IAM Identity Center (AWS Single Sign-On) in the management account. Connect E. Create AWS IAM Identity Center (AWS Single Sign-On) permission sets. Attach the permission. To centralize billing and management and implement identity federation with Azure AD using temporary credentials, an AWS Organization should be established, AWS IAM Identity Center connected to Azure AD, and permission sets created and assigned to federated users for account…
Question
A company has many separate AWS accounts and uses no central billing or management. Each AWS account hosts services for different departments in the company. The company has a Microsoft Azure Active Directory that is deployed. A solutions architect needs to centralize billing and management of the company's AWS accounts. The company wants to start using identity federation instead of manual user management. The company also wants to use temporary credentials instead of long-lived access keys. Which combination of steps will meet these requirements? (Choose three.)
Options
- ACreate a new AWS account to serve as a management account. Deploy an organization in AWS
- BConfigure each AWS account's email address to be [email protected] so that account
- CDeploy AWS IAM Identity Center (AWS Single Sign-On) in the management account. Connect
- DDeploy an AWS Managed Microsoft AD directory in the management account. Share the directory
- ECreate AWS IAM Identity Center (AWS Single Sign-On) permission sets. Attach the permission
- FConfigure AWS Identity and Access Management (IAM) in each AWS account to use AWS
How the community answered
(25 responses)- A56% (14)
- B8% (2)
- D24% (6)
- F12% (3)
Why each option
To centralize billing and management and implement identity federation with Azure AD using temporary credentials, an AWS Organization should be established, AWS IAM Identity Center connected to Azure AD, and permission sets created and assigned to federated users for account access.
Creating a new management account and deploying an organization in AWS Organizations is the foundational step for consolidating billing and centralizing management across multiple AWS accounts.
Configuring account email addresses is a best practice for root account management but does not address consolidated billing, identity federation, or temporary credentials.
Deploying AWS IAM Identity Center (AWS Single Sign-On) in the management account and connecting it to Azure Active Directory is the recommended way to achieve identity federation with an external IdP.
Deploying an AWS Managed Microsoft AD is unnecessary when the company already has Microsoft Azure Active Directory, as IAM Identity Center can integrate directly with Azure AD.
Creating AWS IAM Identity Center permission sets and assigning them to Azure AD users and groups for specific AWS accounts defines the access control and ensures temporary credentials are used via IAM Identity Center's integration with AWS STS.
While AWS STS is used for temporary credentials, configuring IAM in each account separately goes against the goal of centralized management; IAM Identity Center handles this centrally and automatically.
Concept tested: AWS Organizations, IAM Identity Center, Identity Federation, Azure AD Integration
Source: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html
Community Discussion
No community discussion yet for this question.