A company that uses AWS Organizations recently implemented AWS Control Tower The company now needs to centralize identity management. A SysOps administrator must federate AWS AM Identity Center with a

Question

Options

• AA copy of the IAM identity Center SAML metadata
• BThe IdP metadata including the public X 509 certificate
• CThe IP address of the IdP
• DRoot access to the management account
• EAdministrative permissions to the member accounts of the organization

• A
  15% (6)
• B
  74% (29)
• C
  3% (1)
• D
  8% (3)

Explanation

Federating IAM Identity Center with an external SAML 2.0 IdP requires the IdP metadata file (including the public X.509 certificate) because IAM Identity Center uses it to establish trust - the certificate validates that SAML assertions are legitimately signed by the IdP, and without it the federation cannot be configured. Administrative permissions to member accounts (E) are also required because the whole point of this setup is to centrally manage access across all organizational accounts, and the administrator needs authority to configure permission sets and assignments within those accounts.

Why the distractors are wrong:

• A: The IAM Identity Center SAML metadata is something you provide to the IdP (it's an output of the setup process, not a prerequisite you need beforehand).
• C: SAML 2.0 federation is metadata/certificate-based, not IP-address-based; the IdP's IP is irrelevant.
• D: Root access is unnecessary and violates least-privilege - admin-level IAM permissions are sufficient.

Memory tip: Think "give and take" for SAML - you take the IdP metadata (B) from the external provider to configure trust, and you need authority (E) over the accounts you're managing. The IAM Identity Center metadata goes the other direction (to the IdP), so it's not a prerequisite you bring to the table.

No community discussion yet for this question.