Workforce federation (IAM Identity Center, SAML, SCIM): SAP-C03 study notes and practice questions
What to know about Workforce federation (IAM Identity Center, SAML, SCIM) for the SAP-C03 exam, from the Security, Compliance, and Governance domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
These questions describe a company with a corporate directory, dozens or hundreds of AWS accounts, and a rule such as “no IAM users” or “access must be revoked the moment someone leaves.” You pick the federation design that meets it with the least ongoing work.
IAM Identity Center is the default answer
One place for workforce access to every account in AWS Organizations and to integrated applications.
Identity source: the built-in directory, Active Directory (AWS Managed Microsoft AD or a self-managed AD through AD Connector), or an external identity provider such as Microsoft Entra ID, Okta or Google Workspace.
SAML 2.0 handles sign-in from an external IdP. SCIM provisions users and groups automatically, so disabling someone in the IdP removes their AWS access without a manual step.
Permission sets are templates of policies. Assign a permission set to a group in specific accounts, and Identity Center creates and manages the IAM roles in those accounts.
Attributes for access control pass user attributes (department, cost center, project) into the session as tags, which enables ABAC across accounts with one permission set.
Users get short-lived credentials in the console and in the CLI through aws configure sso.
Run day-to-day administration from a delegated administrator member account rather than the management account.
Direct IAM federation
IAM SAML providers and IAM OIDC providers let an IdP or token issuer assume roles in one account directly. They still fit for a single account, for an existing setup, or for machines.
OIDC for CI/CD: GitHub Actions and similar systems call AssumeRoleWithWebIdentity. Lock the role’s trust policy to the token’s aud and sub claims (repository, branch or environment).
Workforce access for many accounts through hand-built SAML roles in every account is the older pattern the exam steers away from.
How to choose
Scenario wording
Pick
Hundreds of accounts, existing Okta or Entra ID, minimal admin
Identity Center with external IdP, SAML and SCIM
Users and groups must stay in sync automatically
SCIM provisioning
On-premises Active Directory, no cloud IdP
Identity Center with AD Connector or AWS Managed Microsoft AD
Access by department without a permission set per team
A retailer has 12 AWS accounts for its stores, e-commerce, data and finance teams. Its employees sign in with the company's identity provider, which supports SAML 2.0, and each employee needs a role in only some of the accounts. Every account is managed by the same central IT team.
When an employee leaves the company, their access to every account must end on the same day, with no separate cleanup in each account. The security team does not want IAM users in any account.
Which solution meets these requirements?
Choose one answer.
AA. Create IAM users in each account for each employee, and disable their access keys and console passwords when they leave.
BB. Create one Amazon Cognito user pool for the workforce, and in each account create an IAM role that trusts a Cognito identity pool, so employees assume the role after they sign in.
CC. Connect AWS IAM Identity Center to the company's identity provider with SAML 2.0, use SCIM to sync users and groups, and assign permission sets to groups in each account.
DD. Give each employee a long-term access key stored in a shared password manager, and rotate every key on the day an employee leaves.
Show the answer and explanation
Answer: C
A. Wrong: IAM users in 12 accounts multiply the cleanup work, and a missed account keeps access alive after the employee leaves. The security team also ruled out IAM users in any account.
B. Wrong: Cognito user pools are built for app end users, and the setup does not give the company the account-level assignments or the directory sync it needs. Removing a user would still leave account roles to clean up.
C. Right: Correct. Identity Center federates employees from the identity provider and syncs deprovisioning through SCIM, so removing a user in the directory ends access everywhere. Permission sets give each group a role in only the accounts it needs, and no IAM users are created.
D. Wrong: Long-term access keys are not federated and are hard to tie to a person, and rotating them on departure is a manual task across all accounts. This design also conflicts with the security team's stance on long-lived credentials.
Explanation
IAM Identity Center with SAML federation and SCIM provisioning gives one place to assign and remove access across accounts, without IAM users. Per-account users, Cognito and shared access keys each leave cleanup or credential risk in place.
Want more on Workforce federation (IAM Identity Center, SAML, SCIM)? The 5 full-length practice sets have 7 more Workforce federation (IAM Identity Center, SAML, SCIM) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Workforce federation (IAM Identity Center, SAML, SCIM)