Hotspot Question A security engineer needs to implement AWS IAM Identity Center with an external identity provider (IdP). Select and order the correct steps from the following list to meet this requir

Question

Exhibits

Answer Area

• Step 1Obtain the SAML metadata from the external IdP.
  Select...Configure the external IdP as the identity source in IAM Identity Center.Create an IAM role that has a trust policy that specifies the IdP's API endpoint.Enable automatic provisioning in IAM Identity Center settings.Enable automatic provisioning in the external IdP.Obtain the SAML metadata from IAM Identity Center.Obtain the SAML metadata from the external IdP.
• Step 2Obtain the SAML metadata from IAM Identity Center.
  Select...Configure the external IdP as the identity source in IAM Identity Center.Create an IAM role that has a trust policy that specifies the IdP's API endpoint.Enable automatic provisioning in IAM Identity Center settings.Enable automatic provisioning in the external IdP.Obtain the SAML metadata from IAM Identity Center.Obtain the SAML metadata from the external IdP.
• Step 3Configure the external IdP as the identity source in IAM Identity Center.
  Select...Configure the external IdP as the identity source in IAM Identity Center.Create an IAM role that has a trust policy that specifies the IdP's API endpoint.Enable automatic provisioning in IAM Identity Center settings.Enable automatic provisioning in the external IdP.Obtain the SAML metadata from IAM Identity Center.Obtain the SAML metadata from the external IdP.

Explanation

AWS IAM Identity Center - External IdP Integration

This question tests knowledge of the SAML 2.0 federation setup process between AWS IAM Identity Center and an external IdP (e.g., Okta, Azure AD, Ping).

Step 1: Obtain the SAML metadata from the external IdP

Why correct: The process begins on the IdP side. The external IdP's SAML metadata XML contains its entity ID, SSO URLs, and signing certificates - information AWS needs to trust the IdP's assertions. You cannot configure AWS without this data first.

Why the others are wrong:

• Obtain metadata from IAM Identity Center - This comes later (Step 2); you need the IdP metadata before AWS can be configured.
• Configure the external IdP as the identity source - You can't do this without both sides' metadata exchanged.
• Enable automatic provisioning (either side) - Provisioning (SCIM) is set up after the SAML trust is established.
• Create an IAM role with trust policy for IdP's API endpoint - This is for direct IAM federation (not IAM Identity Center), and uses IAM roles for SAML, not Identity Center's workflow.

Step 2: Obtain the SAML metadata from IAM Identity Center

Why correct: After registering the IdP's metadata in AWS, IAM Identity Center generates its own SAML metadata (service provider metadata). This SP metadata must then be uploaded into the external IdP so the IdP knows where to send assertions and how to sign them for AWS.

Why the others are wrong:

• Obtain metadata from the external IdP - Already done in Step 1.
• Configure the external IdP as identity source - This step in the AWS console happens before you can retrieve the SP metadata; but full configuration requires the SP metadata to be fed back to the IdP, so the exchange is sequential.
• Enable automatic provisioning - Still premature; SAML trust must be fully established first.
• Create an IAM role with trust policy - Wrong service model entirely for Identity Center federation.

Step 3: Configure the external IdP as the identity source in IAM Identity Center

Why correct: With both metadata documents exchanged, you now return to the IAM Identity Center console and formally set the external IdP as the identity source. This completes the SAML trust relationship, enabling SSO. Automatic provisioning (SCIM) is an optional enhancement configured after this step if needed.

Why the others are wrong:

• Enable automatic provisioning in IAM Identity Center settings - This is a follow-on step (SCIM for user sync), not part of the core three-step SAML trust establishment.
• Enable automatic provisioning in the external IdP - Same reasoning; SCIM provisioning on the IdP side also comes after the SAML trust is working.
• Create an IAM role with trust policy - This belongs to legacy IAM SAML federation, not IAM Identity Center architecture.

The Core Technical Concept

This follows the standard SAML 2.0 SP-initiated federation handshake:

External IdP metadata -> [into AWS]
AWS SP metadata       -> [into external IdP]
AWS Identity Source   -> set to external IdP

IAM Identity Center acts as the Service Provider (SP); the external IdP acts as the Identity Provider. Both sides must trust each other via metadata exchange before SSO can function. SCIM provisioning is a separate, subsequent concern for keeping user/group data synchronized.

No community discussion yet for this question.