A company wants employees to sign in once using their existing corporate directory credentials and then access multiple AWS accounts, without AWS Organizations creating a separate IAM user in each individual account. Which AWS service is designed for this centralized workforce access pattern?
- AWS IAM Identity Center (the successor to AWS SSO), federating a central identity source to permission sets across multiple accounts
- Creating an identical IAM user with the same password in every member account
- Amazon Cognito user pools attached to each account's root user
- AWS Certificate Manager, issuing a shared client certificate to every employee
Why A? And why not the others?
Correct answer: A. AWS IAM Identity Center (the successor to AWS SSO), federating a central identity source to permission sets across multiple accounts
AWS IAM Identity Center connects to a central identity source, such as an existing corporate directory or an external identity provider, and lets administrators assign permission sets to that identity across many AWS accounts at once, so an employee signs in once and is federated into whichever accounts they are assigned, with no separate IAM user ever created per account. The option of creating an identical IAM user with the same password in every account is wrong because it is exactly the duplicated per-account identity the company wants to avoid, and it also multiplies the number of long-lived credentials that must be individually secured and rotated. The option describing Amazon Cognito user pools attached to each account's root user is wrong because Cognito user pools are designed to authenticate end users of an application, not federate workforce staff into the AWS Management Console, and attaching anything to a root user is not how Cognito or console federation works. The option describing AWS Certificate Manager is wrong because that service issues and manages TLS/SSL certificates for encrypting network traffic; it plays no role in authenticating employees or granting console access.
Source: AWS documentation: AWS IAM Identity Center — What is IAM Identity Center