Federation and IAM Identity Center: DOP-C02 study notes and practice questions
What to know about Federation and IAM Identity Center for the DOP-C02 exam, from the Security and Compliance domain (17% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
These questions ask how to give people and external systems access to many accounts without long-lived keys.
IAM Identity Center for people
Connect a corporate identity provider (Microsoft Entra ID, Okta, Google Workspace, Active Directory) as the identity source.
SCIM provisioning keeps users and groups in sync automatically.
Permission sets define access; assign them to groups in specific accounts, and Identity Center creates the roles.
Users get short-lived credentials in the console and CLI (aws sso login / aws configure sso).
Attributes for access control pass identity attributes as session tags for ABAC.
Run it from a delegated administrator account.
Federation for machines
IAM OIDC identity providers let external CI systems (such as GitHub Actions, GitLab or Bitbucket pipelines) exchange a short-lived token for role credentials with AssumeRoleWithWebIdentity.
Restrict the role’s trust policy with conditions on the token’s sub (repository and branch or environment) and aud claims, so only the right repository and branch can assume it.
IAM Roles Anywhere gives on-premises servers temporary credentials using X.509 certificates.
SAML 2.0 providers federate directly into IAM roles for older setups.
Apps and users
Amazon Cognito federates end users of your apps; it’s not for workforce access to AWS accounts.
Common traps
IAM users with access keys for each person or each CI system.
An OIDC trust policy without a sub condition, letting any repository assume the role.
Creating roles by hand in every account instead of permission sets.
A hospital network uses its corporate identity provider, which supports SAML 2.0 and SCIM, for all staff sign-ins. Clinicians need console access to 40 AWS accounts, with different permissions in production and in the research accounts.
When a clinician joins or leaves a department, that person's access should be added or removed automatically, without an administrator working in each account. The hospital does not want any long-lived IAM users for clinicians.
Which approach meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Create an IAM user for each clinician in each account that needs access, with a console password that the clinician rotates every 90 days.
BB. Connect IAM Identity Center to the corporate provider over SAML, turn on SCIM provisioning, and assign directory groups to accounts with permission sets.
CC. Set up a separate SAML identity provider in each of the 40 accounts, and map each identity provider to a role that the department's administrator maintains.
DD. Share a single administrator account with all clinicians, and ask each department to record who is using it in a shared log for the audit team.
Show the answer and explanation
Answer: B
A. Wrong: IAM users in 40 accounts would need to be created and removed by hand, and they are long-lived credentials the hospital wants to avoid. The approach does not follow the corporate directory.
B. Right: Correct. Identity Center federates sign-ins from the corporate provider over SAML, SCIM provisions users and groups from the directory, and permission sets set the access in each account. No IAM users are created for clinicians. Learn more: Manage AWS accounts with permission sets (opens in a new tab)
C. Wrong: A separate identity provider and role mapping in each account multiplies the setup and upkeep. Each change would still need an administrator in every account.
D. Wrong: A shared account removes individual accountability and the directory-based access the hospital needs. A manual log is not an audit control that CloudTrail would provide.
Explanation
IAM Identity Center federates sign-ins from the corporate identity provider, SCIM keeps users and groups synchronized with the directory, and permission sets define access in each account. Clinicians need no IAM users, and joiners and leavers are handled centrally. Per-account users, per-account identity providers and shared accounts each add manual work or lose accountability.
An airline's engineering teams deploy services from GitHub Actions workflows into AWS accounts. The current workflows use long-lived access keys stored as GitHub secrets, and the security team has asked for those keys to be removed.
Deployment roles must trust only the approved repository and the main branch, and no access keys may be stored outside AWS. Engineers also need console access that follows their membership in directory groups, which the airline manages in its corporate directory.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Create an IAM user for each workflow, store its access key in a secrets manager that the workflows read, and rotate the key every month with a scheduled Lambda function.
BB. Create an IAM OIDC identity provider for GitHub, and a deployment role whose trust policy checks the token's subject claim against the approved repository and the main branch.
CC. Give every engineer a shared IAM user with console access and an MFA device, and let the engineers record the account in their own password manager.
DD. Assign IAM Identity Center permission sets to groups synchronized from the corporate directory, so that each engineer's console access follows the group membership in the directory.
EE. Use IAM Roles Anywhere for the workflows, with an X.509 certificate and its private key stored as GitHub secrets, and a trust anchor that maps the certificate to the deployment role.
An IAM OIDC identity provider for GitHub lets a workflow exchange a short-lived token for role credentials, and a trust policy condition on the token's subject limits which repository and branch can assume the role, so no secrets are stored. Identity Center permission sets assigned to directory groups make console access follow group membership. Stored keys, certificates kept in GitHub and shared users each break a requirement.
Want more on Federation and IAM Identity Center? The 5 full-length practice sets have 9 more Federation and IAM Identity Center questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →