An enterprise wants to use its existing directory to assign users to several AWS accounts.
Avoid creating large numbers of individual IAM users in every account.
Choose TWO appropriate design elements.
IAM Identity Center can federate with an external identity provider, assign permission sets to accounts, and use temporary credentials for AWS access.
Detailed explanation
Many long-term users increase administration and credential risk.
Many long-term users increase administration and credential risk.
Federated access can use STS temporary credentials for the resulting AWS session.
Federated access can use STS temporary credentials for the resulting AWS session.
Sharing root access is not a federation design and creates a critical risk.
Sharing root access is not a federation design and creates a critical risk.
Identity Center supports external federation and centralized account and permission-set assignments.
Identity Center supports external federation and centralized account and permission-set assignments.
Check official documentation
Compare the following points with the official documentation.
AWS IAM Identity Centerの外部IdP・Permission Set・アカウント割り当てを確認する。
What to confirm
外部IdP、Identity Center、STSを組み合わせたフェデレーション設計を説明できる。
Key points
- IAM Identity Center
- External identity provider
- Permission set
- Federation
Notes
- Environment: AWS公式IAM Identity Centerの確認
- Confirm current AWS service behavior and security guidance in the official documentation.
Foundation review
Centralized workforce access
Identity Center reduces per-account user management by centralizing assignments and permissions.
Session credentials
After federation, the AWS session uses temporary credentials rather than a long-term user key.