Exams / SCS-C03 / Study guide / Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service)
Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service): SCS-C03 study notes and practice questions
What to know about Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service) for the SCS-C03 exam, from the Identity and Access Management domain (20% of the exam guide), then 2 free questions to test it. Part of the SCS-C03 study guide.
These questions describe employees who need console and CLI access to many accounts, plus a rule such as “users must sign in with corporate credentials,” “MFA is mandatory,” or “access must end the day someone leaves.” The right answer centralizes workforce identity in one place and removes the need for IAM users in each account.
Identity Center and its identity source
IAM Identity Center is the workforce entry point for every account in AWS Organizations. Users get short-lived credentials in the console, or in the CLI through aws configure sso.
The identity source is one of three things: the built-in Identity Center directory, a directory service (AWS Managed Microsoft AD, or a self-managed Active Directory reached through AD Connector), or an external identity provider such as Microsoft Entra ID, Okta or Google Workspace, connected over SAML 2.0.
SCIM provisions and removes users and groups automatically. SAML handles sign-in only. Without SCIM, a person removed in the corporate directory can keep their access until someone deletes the assignment by hand.
Permission sets are policy templates. Assigning a group to a permission set in an account makes Identity Center create the matching IAM role in that account, so you do not build roles by hand.
MFA comes from the identity source. With an external identity provider, enforce MFA in that provider, because Identity Center trusts the provider’s sign-in.
Delegated administration lets a member account run Identity Center, so the management account stays free of workloads.
How to choose
Scenario wording
Pick
Hundreds of accounts, an existing corporate IdP, no IAM users
IAM Identity Center with the external IdP over SAML 2.0
Accounts must be disabled automatically when someone leaves
SCIM provisioning from the IdP
Employees sign in to an on-premises Active Directory, no cloud IdP
IAM Identity Center with AD Connector
Domain-joined Windows servers or LDAP apps need a managed directory
AWS Managed Microsoft AD
Every workforce sign-in must use MFA
MFA enforced in the identity source
Customers sign in to your application
Amazon Cognito, not Identity Center
Common traps
IAM users with access keys for each employee, or one shared admin user.
SAML without SCIM when the requirement is automatic deprovisioning.
Enforcing MFA only in Identity Center when an external IdP handles the sign-in.
Confusing AD Connector with AWS Managed Microsoft AD. AD Connector forwards requests to your existing directory and stores no copy of it. AWS Managed Microsoft AD is a full directory hosted in AWS.
Running Identity Center administration from the management account when a delegated administrator would keep that account clean.
Cognito for employee console access. Cognito is for application users.
A consulting firm runs 40 AWS accounts for its clients and manages its employees in an external identity provider. Contractors join and leave projects every few weeks, and their access must end within one hour of removal from the identity provider.
The security team wants engineers to sign in through that identity provider, with no IAM users in any account. Access should be granted by job role across all accounts, and changes should be made in one place.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Configure SAML sign-in from the identity provider to IAM Identity Center. Create each user in Identity Center by hand, and assign each person's permission sets account by account.
BB. Configure SAML sign-in and SCIM provisioning from the identity provider to IAM Identity Center. Use a Lambda function to copy each group into an IAM role in every account, so that the roles follow the groups.
CC. Configure SAML sign-in and SCIM provisioning from the identity provider to IAM Identity Center. Assign permission sets to the identity provider groups for each account, so removing a user from a group removes access everywhere.
DD. Create an IAM SAML identity provider and one federated role in each account for each job function. Ask the identity provider admins to remove contractors from the role trust list when their projects end.
Show the answer and explanation
Answer: C
A. Wrong: SAML sign-in works, but manual user creation means a removed contractor keeps access until someone deletes the Identity Center user. Assigning permission sets one account at a time also multiplies the work across 40 accounts.
B. Wrong: Provisioning keeps users current, but copying groups into IAM roles adds custom code to maintain in 40 accounts. Roles created outside Identity Center sit outside its permission set model, so the team runs two access systems.
C. Right: Correct. SCIM removes deprovisioned contractors from Identity Center, and group-based permission set assignments apply across all accounts from one place. This meets the one-hour removal rule with no IAM users and no custom code. Learn more: Automatic provisioning in IAM Identity Center (opens in a new tab)
D. Wrong: Federation avoids IAM users, but the role trust must be edited in 40 accounts whenever a contractor leaves. Removal then depends on manual edits that can be late, which misses the one-hour requirement.
Explanation
IAM Identity Center can use an external identity provider for sign-in through SAML and keep users and groups current through SCIM. Group-based permission set assignments then give the right access across 40 accounts from one place. Manual users, copied roles, and per-account trust edits each fail a stated requirement.
A state university research office runs analytics on sensitive student and grant data. Analysts sign in with IAM Identity Center. Today every analyst uses one shared IAM role to query the data, so the audit logs cannot show which person ran each query.
The office needs each query to run as the analyst's own identity, so that the same data-access rules apply to each person. Access should follow group membership in the university identity provider, and the office does not want to create IAM users or access keys.
Which TWO changes meet these requirements? (Choose two.)
Choose two answers.
AA. Keep the shared role, and add an IAM policy condition that requires each caller to tag the query with the analyst user name. The audit logs will then show the name for every query that runs.
BB. Create one IAM user and access key for each analyst in the research account, and have each analyst store the key in their analytics tool. Each query then runs under a separate user.
CC. Enable trusted identity propagation for the IAM Identity Center instance, and configure the analytics applications to accept identity-enhanced sessions from it.
DD. Assign the university data-access groups to the analytics applications in IAM Identity Center, so that each group's members can open those applications and the access follows the identity provider groups.
EE. Move the sensitive data into a separate AWS account for each analyst, with its own copy of the data and an IAM role for that analyst. Each analyst then queries only their own copy of the data.
Show the answer and explanation
Answers: C, D
A. Wrong: Tags are set by the caller, so a user can enter any name, and the shared role still hides the real identity. The logs would show what the caller said, not a verified identity.
B. Wrong: Separate IAM users do give separate identities, but long-term access keys are hard to manage and rotate for many analysts. The office does not want IAM users or access keys, so this option breaks the requirement.
C. Right: Correct. Trusted identity propagation carries each analyst's identity into the analytics services, so queries and audit logs name the person. No IAM users or shared roles are needed for those sessions. Learn more: Trusted identity propagation overview (opens in a new tab)
D. Right: Correct. Group assignments in Identity Center mean that access follows the identity provider groups, and adding or removing a member changes access without new policies. Together with propagation, the access rules stay tied to each person.
E. Wrong: Separate accounts and copies isolate analysts, but they multiply storage and make shared grant data impractical. The copies would drift apart, which breaks the shared access rules the office needs.
Explanation
Trusted identity propagation keeps each analyst's identity attached to queries, and Identity Center application assignments control which groups from the identity provider can reach each application. The shared role, caller-set tags, per-user keys, and per-analyst copies each miss one requirement.
Want more on Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service)? The 5 full-length practice sets have 6 more Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Workforce identity and MFA (IAM Identity Center, external IdPs, Directory Service)