SAA-C03 Q297 · IAM

Question

A company sets up an organization in AWS Organizations that contains 10 AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees. The company has an existing identity provider (IdP). The company wants to use the existing IdP for authentication to AWS. Which solution will meet these requirements?

Accepted Answer

**Option C: AWS IAM Identity Center with external IdP** is correct because it satisfies every requirement:

1. **Multi-account access**: IAM Identity Center is natively integrated with AWS Organizations. It provides a single point to manage access across all 10 AWS accounts without configuring federation separately in each account.

2. **Existing IdP**: IAM Identity Center supports connecting to external identity providers (Okta, Azure AD, Ping Identity, etc.) via SAML 2.0 or SCIM. This means the company can keep using their existing IdP for authentication.

3. **Several thousand employees**: IAM Identity Center supports automatic provisioning of users and groups from the external IdP using SCIM (System for Cross-domain Identity Management). This eliminates the need to manually create thou

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips