Which AWS Service Provides a Portal for Assigned AWS Accounts and SaaS Apps?

CLF-C02 By islever Editorial Last updated

Identify AWS access management capabilities.

Short answer

B AWS IAM Identity Center (AWS SSO) provides a central portal for assigned AWS accounts and third-party SaaS application access.

Question

A company wants to manage access and permissions for its third-party software as a service (SaaS) applications. The company wants to use a portal where end users can access assigned AWS accounts and AWS Cloud applications. Which AWS service should the company use to meet these requirements?
  1. Amazon Cognito
  2. AWS IAM Identity Center (AWS Single Sign-On) Correct Answer
  3. AWS Identity and Access Management (IAM)
  4. AWS Directory Service for Microsoft Active Directory

Key Takeaways

The question tests IAM Identity Center's workforce SSO portal for AWS accounts and SaaS apps; the trap is confusing it with IAM, which manages permissions but does not provide the end-user access portal or SaaS federation described.

AWS IAM Identity Center (AWS Single Sign-On) is the service for centrally managing workforce access to assigned AWS accounts and third-party SaaS applications through a single user portal. The answer is B, not standalone IAM, Cognito, or AWS Directory Service.

Common mistake: A common mistake is choosing AWS Identity and Access Management (IAM) because it also controls AWS permissions, but IAM alone does not provide the centralized end-user portal or third-party SaaS SSO features described.

Expert Analysis

Why the Answer Is Correct

AWS IAM Identity Center, formerly AWS Single Sign-On, is designed for workforce identities and central access management. It provides a user portal where end users can see and access the AWS accounts and cloud applications assigned to them, including third-party SaaS applications that support SAML federation. The scenario's two requirements—managing access and permissions for third-party SaaS apps and giving end users a portal to assigned AWS accounts and AWS Cloud applications—map directly to IAM Identity Center. It is also the recommended AWS service for centralized workforce access across multiple AWS accounts.

Why the Other Options Are Wrong

Amazon Cognito is for customer-facing identity and access management in web and mobile applications, not for workforce access to AWS accounts and SaaS apps. AWS IAM is the underlying permissions system for AWS resources; it can define policies and roles, but it does not provide the described end-user portal or manage SaaS application assignments. AWS Directory Service for Microsoft Active Directory is a managed Microsoft AD service, useful for directory-aware workloads and domain joins, but it is not the central AWS portal for assigned accounts and SaaS applications. Therefore, A, C, and D do not meet the full requirement.

Community Comment Notes

The comments are unanimous for B: ShaiTay answered "AWS IAM Identity Center (AWS Single Sign-On)", and its_tima described it as a way to "manage their access centrally across AWS accounts and applications." That phrasing aligns with the AWS documentation and with the portal requirement in the question. No comment argues for Cognito, IAM, or Directory Service. The consensus is useful confirmation, but the decisive factor remains the requirement for a central end-user portal plus SaaS application access.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

For CLF-C02 access-management questions, map the scenario's key noun: a central portal for workforce identities and assigned AWS accounts or SaaS apps points to IAM Identity Center, while fine-grained permissions for AWS resources alone points to IAM. Eliminate Cognito unless the scenario explicitly describes customer-facing application sign-up or sign-in.

Frequently Asked Questions

Why is AWS IAM not the correct answer for the SaaS portal?

IAM manages permissions for AWS resources and identities, but it does not provide the centralized workforce access portal or SaaS application assignment described in the scenario.

Does IAM Identity Center support third-party SaaS applications?

Yes. AWS IAM Identity Center can federate with supported SaaS applications and gives users a single portal for assigned AWS accounts and cloud applications.

More CLF-C02 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. its_tima 👍 2
    B. IAM Identity Center helps you securely create, or connect, your workforce identities and manage their access centrally across AWS accounts and applications.
  2. its_tima 👍 1
    B. AWS IAM Identity Center (AWS Single Sign-On) aka AWS IAM Identity Center*
  3. ShaiTay 👍 1 Answered B
    B. AWS IAM Identity Center (AWS Single Sign-On)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Which migration strategies move a cloud-incompatible CMS with least effort?

S-grade

Launching Third-Party IDS in AWS

S-grade

Which AWS Support Plan Offers API Access Most Cost-Effectively?

S-grade

S3 Express One Zone for Single-Digit Millisecond Latency

S-grade

Practice All CLF-C02 Questions

Access 120 questions with complete answers and detailed explanations.

View Full CLF-C02 Practice Test →

← Back to CLF-C02 Study Guide