SAP-C03 practice question: Workforce federation (IAM Identity Center, SAML, SCIM)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retailer has 12 AWS accounts for its stores, e-commerce, data and finance teams. Its employees sign in with the company's identity provider, which supports SAML 2.0, and each employee needs a role in only some of the accounts. Every account is managed by the same central IT team.
When an employee leaves the company, their access to every account must end on the same day, with no separate cleanup in each account. The security team does not want IAM users in any account.
Which solution meets these requirements?
Choose one answer.
AA. Create IAM users in each account for each employee, and disable their access keys and console passwords when they leave.
BB. Create one Amazon Cognito user pool for the workforce, and in each account create an IAM role that trusts a Cognito identity pool, so employees assume the role after they sign in.
CC. Connect AWS IAM Identity Center to the company's identity provider with SAML 2.0, use SCIM to sync users and groups, and assign permission sets to groups in each account.
DD. Give each employee a long-term access key stored in a shared password manager, and rotate every key on the day an employee leaves.
Show the answer and explanation
Answer: C
A. Wrong: IAM users in 12 accounts multiply the cleanup work, and a missed account keeps access alive after the employee leaves. The security team also ruled out IAM users in any account.
B. Wrong: Cognito user pools are built for app end users, and the setup does not give the company the account-level assignments or the directory sync it needs. Removing a user would still leave account roles to clean up.
C. Right: Correct. Identity Center federates employees from the identity provider and syncs deprovisioning through SCIM, so removing a user in the directory ends access everywhere. Permission sets give each group a role in only the accounts it needs, and no IAM users are created.
D. Wrong: Long-term access keys are not federated and are hard to tie to a person, and rotating them on departure is a manual task across all accounts. This design also conflicts with the security team's stance on long-lived credentials.
Explanation
IAM Identity Center with SAML federation and SCIM provisioning gives one place to assign and remove access across accounts, without IAM users. Per-account users, Cognito and shared access keys each leave cleanup or credential risk in place.
Want more on Workforce federation (IAM Identity Center, SAML, SCIM)? The 5 full-length practice sets have 7 more Workforce federation (IAM Identity Center, SAML, SCIM) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →