AWS IAM Identity Center with Self-Managed AD: Two-Way Trust

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Enable AWS SSO and create a two-way forest trust between the on-premises self-managed Microsoft AD and AWS Managed Microsoft AD through AWS Directory Service.

Question

A company is migrating applications to AWS. The applications are deployed in different accounts. The company manages the accounts centrally by using AWS Organizations. The company's security team needs a single sign-on (SSO) solution across all the company's accounts. The company must continue managing the users and groups in its on-premises self-managed Microsoft Active Directory.
Which solution will meet these requirements?
  1. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a one-way forest trust or a one-way domain trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory.
  2. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a two-way forest trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory. Correct Answer
  3. Use AWS Directory Service. Create a two-way trust relationship with the company's self-managed Microsoft Active Directory.
  4. Deploy an identity provider (IdP) on premises. Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console.

Key Takeaways

It tests the IAM Identity Center prerequisite for a two-way trust with self-managed AD; the main trap is assuming a one-way trust is sufficient because it sounds more restrictive.

This SAA-C03 scenario tests organization-wide single sign-on while identities remain in an on-premises self-managed Microsoft Active Directory. The correct design enables AWS SSO/IAM Identity Center and creates a two-way forest trust between AWS Managed Microsoft AD and the on-premises directory.

Common mistake: Choosing option A because one-way trusts are common for resource access; however, IAM Identity Center requires a two-way trust, so the one-way trust does not meet the documented prerequisite.

Expert Analysis

Organization-wide SSO narrows the field. The phrase "single sign-on (SSO) solution across all the company's accounts" combined with accounts managed in AWS Organizations points to AWS SSO/IAM Identity Center as the account-level identity service. Option C only builds a directory trust relationship; it never enables SSO across the organization's accounts, so C cannot satisfy the scenario. Option D deploys an on-premises IdP but does not specify integration with the existing self-managed Microsoft AD, and it adds a new IdP layer rather than using AWS Managed Microsoft AD as the expected bridge. The requirement to "continue managing the users and groups" in the on-premises self-managed AD also rules out moving identities into the IAM Identity Center directory.

The trust direction is the discriminator. Both A and B enable AWS SSO and use AWS Directory Service for Microsoft Active Directory, so the decision comes down to the trust type. IAM Identity Center requires a two-way trust between AWS Managed Microsoft AD and the self-managed AD. A one-way trust only permits authentication in one direction and does not meet the documented prerequisite. Comments that favor A often reason that a one-way trust is more restrictive or "least privilege"; that is a plausible security instinct, but it is not the IAM Identity Center requirement. Other comments correctly note that one-way trusts do not work for this integration. Option A also offers "a one-way forest trust or a one-way domain trust," adding an unsupported variant. Therefore option B is correct: enable AWS SSO and create a two-way forest trust to the on-premises self-managed AD using AWS Managed Microsoft AD.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Separate the identity-provider choice from the trust direction. First ask whether the option enables IAM Identity Center/AWS SSO and preserves on-premises AD as the identity store; options that only configure Directory Service fail the SSO requirement. Then verify the exact trust direction against the IAM Identity Center prerequisite—two-way, not one-way—rather than applying generic least-privilege intuition. This two-step filter removes C and D, then eliminates A.

Frequently Asked Questions

Does IAM Identity Center require a two-way trust with self-managed AD?

Yes. IAM Identity Center uses AWS Managed Microsoft AD as the bridge to a self-managed AD and requires a two-way trust; a one-way trust does not satisfy the documented prerequisite.

Why is option C insufficient for SSO across AWS accounts?

Option C creates a directory trust but does not enable AWS SSO/IAM Identity Center, which is the service that provides account-wide SSO through AWS Organizations.

Can an on-premises IdP be used instead of AWS Managed Microsoft AD?

External IdP federation is possible, but option D does not specify integration with the existing self-managed AD and adds a new IdP to operate; the expected AWS-native design is AWS SSO with AWS Managed Microsoft AD and a two-way trust.

More SAA-C03 FAQ →

Community Votes

B
45%
A
45%
D
6%
C
4%

45% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 90 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 90

  1. 17Master 👍 80 Answered B
    Tricky question!!! forget one-way or two-way. In this scenario, AWS applications (Amazon Chime, Amazon Connect, Amazon QuickSight, AWS Single Sign-On, Amazon WorkDocs, Amazon WorkMail, Amazon WorkSpaces, AWS Client VPN, AWS Management Console, and AWS Transfer Family) need to be able to look up objects from the on-premises domain in order for them to function. This tells you that authentication needs to flow both ways. This scenario requires a two-way trust between the on-premises and AWS Managed Microsoft AD domains. It is a requirement of the application Scenario 2: https://aws.amazon.com/es/blogs/security/everything-you-wanted-to-know-about-trusts-with-aws-managed-microsoft-ad/
  2. KADSM 👍 14
    Answer B as we have AWS SSO which requires two way trust. As per documentation - A two-way trust is required for AWS Enterprise Apps such as Amazon Chime, Amazon Connect, Amazon QuickSight, AWS IAM Identity Center (successor to AWS Single Sign-On), Amazon WorkDocs, Amazon WorkMail, Amazon WorkSpaces, and the AWS Management Console. AWS Managed Microsoft AD must be able to query the users and groups in your self-managed AD. Amazon EC2, Amazon RDS, and Amazon FSx will work with either a one-way or two-way trust.
  3. pbpally 👍 12
    What I did find though was documentation that explicitly states that IAM Identity Center (successor to AWS SSO) requires a two-way trust: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html
  4. mohamedsambo 👍 8
    AWS IAM Identity Center requires a two-way trust so that it has permissions to read user and group information from your domain to synchronize user and group metadata. IAM Identity Center uses this metadata when assigning access to permission sets or applications. User and group metadata is also used by applications for collaboration, like when you share a dashboard with another user or group. The trust from AWS Directory Service for Microsoft Active Directory to your domain permits IAM Identity Center to trust your domain for authentication. The trust in the opposite direction grants AWS permissions to read user and group metadata.
  5. cookieMr 👍 7 Answered A
    The recommended solution is option A: Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console and create a one-way forest trust or a one-way domain trust to connect the company's self-managed Microsoft Active Directory with AWS SSO using AWS Directory Service for Microsoft Active Directory. By implementing this solution, the company can achieve a single sign-on experience for their AWS accounts while maintaining central control over user and group management in their on-premises Active Directory. The one-way trust ensures that user and group information flows securely from the on-premises directory to AWS SSO, allowing for centralized access management and control across all AWS accounts.
Show 25 more comments
  1. pbpally 👍 7
    I found the documentation that explicitly states that IAM Identity Center (successor to AWS SSO) requires a two-way trust: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html
  2. Buruguduystunstugudunstuy 👍 5 Answered A
    The solution that will meet these requirements is A: Enable AWS Single Sign-On (AWS SSO) from the AWS SSO console. Create a one-way forest trust or a one-way domain trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory. AWS Single Sign-On (AWS SSO) is a service that enables users to sign in to all of their accounts in AWS Organizations centrally by using their corporate credentials. To use AWS SSO with a self-managed Microsoft Active Directory, the company can enable AWS SSO from the AWS SSO console and create a one-way forest trust or a one-way domain trust by using AWS Directory Service for Microsoft Active Directory. This will allow the company to continue managing the users and groups in its on-premises self-managed Microsoft Active Directory while providing a single sign-on solution across all the company's accounts.
  3. KVK16 👍 5 Answered B
    In this there is requirement of trust two ways - from On Prem domain to AWS domain. They both will trust each other. One-way trust : If Domain A is trusting Domain B , users from Domain B can access resources of Domain A but not vice-versa. So for A - its Outgoing trust and for B its incoming trust. AWS applications (Amazon Chime, Amazon Connect, Amazon QuickSight, AWS Single Sign-On, Amazon WorkDocs, Amazon WorkMail, Amazon WorkSpaces, AWS Client VPN, AWS Management Console, and AWS Transfer Family) need to be able to look up objects from the on-premises domain in order for them to function. This tells you that authentication needs to flow both ways. For Elaborate details refer https://aws.amazon.com/blogs/security/everything-you-wanted-to-know-about-trusts-with-aws-managed-microsoft-ad/
  4. Buruguduystunstugudunstuy 👍 5
    Option B, creating a two-way forest trust, is not a good choice because it would allow the self-managed Microsoft Active Directory to manage the AWS SSO directory and potentially make unauthorized changes. Option C, using AWS Directory Service, is not a good choice because it would require the company to manage the directory in the cloud and would not allow the company to continue using its self-managed Microsoft Active Directory. Option D, deploying an identity provider (IdP) on premises, is not a good choice because it would not provide a single sign-on solution across all the company's accounts in AWS Organizations.
  5. pbpally 👍 5
    The problem with this is that nowhere in the question is it saying that the application needs to be able to flow back so two-way is not needed.
  6. MatAlves 👍 5
    Current version of this question (with Identity Center) doesn't even contain option A. a public discussion thread on this question
  7. HoaHK 👍 5
    Right, but with Active Directory, two-way trust is require
  8. SilentMilli 👍 4 Answered A
    AWS Single Sign-On (AWS SSO) does not require a two-way trust. It allows you to manage user identities and group membership in your self-managed Microsoft Active Directory and to use those identities to grant users access to your AWS accounts. A two-way trust relationship is not required for AWS SSO to function. A one-way forest trust or a one-way domain trust is sufficient.
  9. BlueVolcano1 👍 4
    AWS docs specifically say this: "One-way trusts do not work with IAM Identity Center." (Identity Centre is the successor to AWS SSO) https://docs.aws.amazon.com/singlesignon/latest/userguide/connectonpremad.html
  10. awsgeek75 👍 4 Answered B
    I'll go for B as A feels incomplete C Can be done but company wants SSO, not a fill director service D On prem already has a IDP so no.
  11. Richaqua 👍 4
    You need one way trust if it is an AD connector. With MS AD, two way trust will be required
  12. darkknight23 👍 3
    I think its A. From ChatGpt: ========= Should this be one way or two way trust? To integrate AWS SSO with an on-premises Microsoft Active Directory, a one-way trust relationship should be established. In a one-way trust relationship, the on-premises Microsoft Active Directory trusts the AWS SSO directory, but the AWS SSO directory does not trust the on-premises Microsoft Active Directory. This means that users and groups in the on-premises Microsoft Active Directory can be mapped to AWS SSO users and groups, but not vice versa. This is the recommended approach for security reasons, as it ensures that the on-premises Microsoft Active Directory is not exposed to external entities. The one-way trust relationship also simplifies administration and reduces the risk of errors in configuration.
  13. Clouddon 👍 3 Answered A
    Why the Other Options Are Incorrect: B. Two-way forest trust Unnecessary and more complex than a one-way trust. A one-way trust from AWS to on-prem AD is sufficient and recommended by AWS for this use case. C. Use AWS Directory Service with two-way trust only This option is incomplete — it lacks integration with AWS SSO (IAM Identity Center), which is required for SSO across AWS accounts. Also, two-way trust is not required, increasing complexity unnecessarily. D. Deploy an on-prem IdP + enable AWS SSO Possible, but adds significant operational overhead by requiring you to deploy and manage a full SAML 2.0 IdP. Not needed when AWS SSO supports direct integration with self-managed AD via AWS Managed Microsoft AD and trust relationships.
  14. MGKYAING 👍 3 Answered A
    AWS Single Sign-On (AWS SSO) allows centralized management of access to multiple AWS accounts, and it integrates with on-premises Active Directory via AWS Directory Service for Microsoft Active Directory. A one-way trust enables AWS Directory Service to authenticate users from the on-premises AD without giving AWS access to manage the on-premises AD. This is secure and follows best practices. This is the correct solution because it integrates the on-premises AD with AWS SSO and maintains the centralized management of users and groups in the on-premises AD.
  15. omunoz 👍 3 Answered A
    A one-way trust (rather than a two-way trust) is the recommended approach for security reasons: The on-premises AD remains the authoritative identity provider. AWS trusts the on-prem AD, but AD does not trust AWS. This setup ensures that AWS does not introduce potential security risks to the on-premises A two-way trust is unnecessary for SSO and can introduce security risks, as it allows AWS to authenticate users in the on-prem AD and vice versa. AWS best practices recommend using a one-way trust for such integrations.
  16. PoolDead 👍 3 Answered B
    Option B (enabling AWS SSO and creating a two-way forest trust) is the appropriate solution based on the requirement for a two-way trust to support AWS enterprise applications and provide single sign-on capabilities across all AWS accounts while integrating with the on-premises Microsoft Active Directory.
  17. secdaddy 👍 3
    Per the URL provided by 17Master, Amazon Single Sign On requires a two way trust relationship as shown in scenario 2 https://aws.amazon.com/es/blogs/security/everything-you-wanted-to-know-about-trusts-with-aws-managed-microsoft-ad/
  18. Ruffyit 👍 3
    Two-way trust or AD Connector. IAM Identity Center only works with those two. "One-way trusts do not work with IAM Identity Center." https://docs.aws.amazon.com/singlesignon/latest/userguide/connectonpremad.html
  19. ruqui 👍 3
    that's wrong!!! think yourself instead of relying on software: https://docs.aws.amazon.com/singlesignon/latest/userguide/connectonpremad.html
  20. sbnpj 👍 3 Answered B
    https://docs.aws.amazon.com/singlesignon/latest/userguide/connectonpremad.html
  21. bingusbongus 👍 3
    This solution does not feature single-sign-on (SSO).
  22. cark0728 👍 3 Answered B
    b가 정답입니다
  23. sachin 👍 2
    B Create a two-way trust relationship – When two-way trust relationships are created between AWS Managed Microsoft AD and a self-managed directory in AD, users in your self-managed directory in AD can sign in with their corporate credentials to various AWS services and business applications. One-way trusts do not work with IAM Identity Center. AWS IAM Identity Center (successor to AWS Single Sign-On) requires a two-way trust so that it has permissions to read user and group information from your domain to synchronize user and group metadata. IAM Identity Center uses this metadata when assigning access to permission sets or applications. User and group metadata is also used by applications for collaboration, like when you share a dashboard with another user or group. The trust from AWS Directory Service for Microsoft Active Directory to your domain permits IAM Identity Center to trust your domain for authentication. The trust in the opposite direction grants AWS permissions to read user and group metadata.
  24. Yonimoni 👍 2
    Option B is the correct choice because it aligns with the AWS documentation, which states that a two-way trust relationship is needed between AWS Managed Microsoft AD and a self-managed AD for users to sign in with their corporate credentials to AWS services. This solution integrates AWS SSO, AWS Directory Service for Microsoft AD, and centralized account management through AWS Organizations. Read until the end "Create a two-way trust relationship – When two-way trust relationships are created between AWS Managed Microsoft AD and a self-managed directory in AD, users in your self-managed directory in AD can sign in with their corporate credentials to various AWS services and business applications. One-way trusts do not work with IAM Identity Center." https://docs.aws.amazon.com/singlesignon/latest/userguide/connectonpremad.html
  25. AlaTaftaf 👍 2 Answered A
    This is the answer of chatGPT: Option A is the best solution that meets the requirements of providing a single sign-on (SSO) solution across all the company's accounts while continuing to manage users and groups in the on-premises self-managed Microsoft Active Directory. Explanation: Option A is the best solution as it enables AWS Single Sign-On (AWS SSO) from the AWS SSO console and creates a one-way forest trust or a one-way domain trust to connect the company's self-managed Microsoft Active Directory with AWS SSO by using AWS Directory Service for Microsoft Active Directory. This solution allows the company to manage users and groups in the on-premises Active Directory and provides a single sign-on (SSO) experience across all the company's AWS accounts.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide