Integrating AWS IAM with On-Premises LDAP

Answer - B.

According to https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html, you can use SAML to provide your users with federated single sign-on (SSO) to the AWS Management Console or federated access to call AWS API operations.

Options A, C and D are all incorrect because all of these options cannot help you to enable single sign-on.

The correct answer to the question is B: Use SAML (Security Assertion Markup Language) to enable single sign-on between AWS and LDAP.

Explanation:

AWS IAM (Identity and Access Management) is a web service that helps to securely control access to AWS resources. It allows administrators to manage users, groups, and permissions to access the AWS console and other AWS services. On the other hand, LDAP (Lightweight Directory Access Protocol) is a protocol for accessing and managing distributed directory information services over an IP network. LDAP is commonly used to authenticate and authorize users to access corporate resources, such as email, VPN, and applications.

To integrate AWS IAM with an on-premises LDAP directory service for single sign-on access to AWS console, SAML can be used. SAML (Security Assertion Markup Language) is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider (in this case, the on-premises LDAP directory service) and a service provider (in this case, AWS).

Here are the high-level steps to configure SAML-based single sign-on between AWS and LDAP:

1. Configure an identity provider (IDP) in the on-premises LDAP directory service to issue SAML assertions.
2. Configure a SAML provider in AWS IAM to establish trust between the IDP and AWS.
3. Create an IAM role that defines the permissions required for users to access AWS resources.
4. Configure the SAML provider to map the LDAP attributes to the AWS role and policy.
5. Configure the IDP to redirect the user to the AWS SAML endpoint for authentication.
6. Users can now authenticate to AWS console using their LDAP credentials, and they will be automatically authorized based on the AWS role and policy associated with their LDAP attributes.

Option A is incorrect because IAM policies cannot directly reference LDAP account identifiers. Option C is incorrect because AWS STS is used to grant temporary credentials, and it does not integrate with LDAP for single sign-on. Option D is incorrect because IAM roles are used to delegate permissions to AWS resources and do not directly relate to LDAP credentials.