SAP-C02 Practice Question 2: Identity Center Active Directory Federation
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 1 · question 2 of 10
An enterprise manages 120 AWS accounts that were provisioned through AWS Control Tower Account Factory and are organized into OUs by environment. All 4,000 employees already exist in an on-premises Microsoft Active Directory forest, which remains the authoritative source of identity and is connected to AWS over a redundant AWS Direct Connect link.
The platform team must deliver the following: engineers sign in once with their existing AD credentials and then pick from the AWS accounts and roles they are entitled to; entitlements are driven purely by AD group membership so that a leaver losing their AD account immediately loses AWS access; no long-lived IAM users or access keys exist anywhere; and onboarding a new application team must not require the team to configure anything inside each individual account.
Which solution best satisfies these requirements?
Show answer and explanation
Answer:
IAM Identity Center is the AWS-recommended way to give workforce identities single sign-on across an organization, and it is the identity layer AWS Control Tower expects. It supports Active Directory as an identity source either through AD Connector pointed at the on-premises forest or through AWS Managed Microsoft AD with a two-way trust, so AD stays authoritative and a disabled AD account loses AWS access at the next authentication. Permission sets are defined once centrally and provisioned by Identity Center as IAM roles into each target account, so no application team touches an individual account. Users land in the access portal, choose an account and permission set, and receive short-lived credentials, no IAM users and no access keys.
Option A is the pre-Identity Center pattern and it technically works, but it multiplies effort: an IdP object and a full set of IAM roles must be created and maintained in each of the 120 accounts, and every new account from Account Factory needs the same treatment. The stem's "not require configuration inside each individual account" constraint rules it out.
Option B violates the "no long-lived IAM users or access keys" requirement outright, and home-grown directory synchronization is exactly the operational burden Identity Center removes. External IDs are a third-party-access mechanism, not an internal workforce SSO mechanism.
Option D misuses Amazon Cognito, which is designed for customer-facing application identity, not for workforce administrative access to the AWS Management Console and CLI across many accounts. It offers no account-and-role portal and no permission set model.
Reference: What is AWS IAM Identity Center?