Back to AWS Identity and Access Management (IAM)

Federated Access and Identity Federation

5 minutes 5 Questions

Federated Access and Identity Federation in AWS IAM allows you to grant your organization's users single sign-on access to AWS Management Console using their existing identity system like Microsoft Active Directory, Google Workspace, or other identity providers like Okta or OneLogin. With this feat…

Test mode:
Start practice test
AWS Certified Solutions Architect - Federated Access and Identity Federation Example Questions

Test your knowledge of Federated Access and Identity Federation

Question 1

An organization wants to grant their application running on EC2 access to specific resources in their Amazon S3 bucket. Which method is the most secure way to achieve this?

Correct Answer: Assign an IAM role with appropriate permissions to the Amazon EC2 instance.

The correct method is to assign an IAM role with appropriate permissions to the EC2 instance. This ensures secure access to the Amazon S3 resources without exposing sensitive information, such as root user or IAM user AWS access keys.

Question 2

A company uses a custom Identity Broker to federate users from its existing SAML 2.0 Identity Provider (IdP) into AWS. Focusing on the backend sequence that occurs after the user has successfully authenticated and the IdP has issued a SAML assertion, which ordered flow correctly shows how temporary AWS credentials are obtained and used to access an AWS service?

Correct Answer: Identity Provider --> Identity Broker --> AWS Security Token Service (STS) --> AWS service

After the user authenticates with the SAML IdP, the IdP issues a SAML assertion to the Identity Broker. The broker then calls AWS STS (typically using AssumeRoleWithSAML) to exchange that assertion for temporary AWS credentials. Those credentials are subsequently used to access the target AWS service. Therefore, the correct sequence is IdP -> Identity Broker -> STS -> AWS service. The sequence starting with the broker contacting the IdP is not correct for the post-authentication, post-assertion flow, and Lambda or Amazon Connect are not involved in issuing temporary credentials for federation.

Question 3

A company wants to enable employees to access their AWS Management Console without creating separate AWS IAM user accounts. The employees already have Microsoft Active Directory accounts. Which approach should they pursue?

Correct Answer: Use AWS Security Token Service (STS) to create temporary AWS credentials and use Amazon Connect as the Identity Provider.

Using AWS STS, you can create temporary AWS credentials for federated users who have Active Directory accounts. This avoids creating individual IAM user accounts in AWS. With Amazon Connect as the Identity Provider, you can enable access to the AWS Management Console using the employee's existing Active Directory credentials.

More Federated Access and Identity Federation questions
15 questions (total)
Start 15 question test