A company is using an on-premises Active Directory service for user authentication. The company wants to use the same authentication service to sign in to the company’s AWS accounts, which are using AWS Organizations. AWS Site-to-Site VPN connectivity already exists between the on-premises environment and all the company’s AWS accounts. The company’s security policy requires conditional access to the accounts based on user groups and roles. User identities must be managed in a single location. Which solution will meet these requirements?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose A1
Option A provides: Centralized identity management with Active Directory. Scalable access across AWS accounts using IAM Identity Center + ABAC. Automated provisioning via SCIM. Integration with existing VPN connectivity.
Chose A1
SCIM v2.0 in the Context of AWS SSO and Active Directory When using AWS IAM Identity Center (AWS SSO) with Active Directory, SCIM v2.0 is utilized to automatically provision and de-provision users and groups. This eliminates the need for manual user or group management and ensures that changes in your on-premises AD are reflected in AWS SSO.
Chose A3
keywords: 'Use active directory to sign in Aws accounts' = AWS IAM Identity Center (AWS Single Sign-On) , SAML 2.0 'conditional access to the accounts based on user groups and roles' = AWS IAM (ABAC)
