AWS IAM Identity Center with On-Premises AD Trust

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Enable AWS IAM Identity Center and configure a two-way forest trust between the on-premises AD and AWS Managed Microsoft AD.

Question

A company is migrating applications from an on-premises Microsoft Active Directory that the company manages to AWS. The company deploys the applications in multiple AWS accounts. The company uses AWS Organizations to manage the accounts centrally. The company's security team needs a single sign-on solution across all the company's AWS accounts. The company must continue to manage users and groups that are in the on-premises Active Directory. Which solution will meet these requirements?
  1. Create an Enterprise Edition Active Directory in AWS Directory Service for Microsoft Active Directory. Configure the Active Directory to be the identity source for AWS IAM Identity Center.
  2. Enable AWS IAM Identity Center. Configure a two-way forest trust relationship to connect the company's self-managed Active Directory with IAM Identity Center by using AWS Directory Service for Microsoft Active Directory. Correct Answer
  3. Use AWS Directory Service and create a two-way trust relationship with the company's self-managed Active Directory.
  4. Deploy an identity provider (IdP) on Amazon EC2. Link the IdP as an identity source within AWS IAM Identity Center.

Key Takeaways

The core trap is confusing the identity source for IAM Identity Center; you must use AWS Managed Microsoft AD as the bridge to establish a trust with the on-premises AD, rather than trying to connect IAM Identity Center directly or creating a standalone AD in AWS without the trust link.

This question tests integrating AWS IAM Identity Center with an existing on-premises Microsoft Active Directory using a two-way forest trust via AWS Managed Microsoft AD to enable single sign-on across multiple accounts.

Common mistake: Candidates often choose Option C because it mentions a two-way trust, but it fails to specify that this trust is linked to IAM Identity Center, which is required for the SSO solution across AWS accounts.

Expert Analysis

Why the Answer Is Correct

Option B is correct because it establishes the necessary architecture for Single Sign-On (SSO) while retaining control of the on-premises directory. AWS IAM Identity Center requires an identity source; by deploying AWS Managed Microsoft AD and configuring a two-way forest trust with the on-on-premises Active Directory, the cloud directory can authenticate users against the on-premises source. This allows IAM Identity Center to provide SSO access to all AWS accounts managed by AWS Organizations using the existing user and group definitions.

Why the Other Options Are Wrong

Option A creates a new Enterprise Edition AD in AWS, which implies managing a separate directory rather than extending the existing one, contradicting the requirement to continue managing users in the on-premises AD. Option C mentions creating a trust relationship but does not explicitly link it to IAM Identity Center as the identity provider, leaving the SSO mechanism undefined. Option D suggests deploying a custom IdP on EC2, which is unnecessary complexity when AWS provides native integration capabilities through Managed Microsoft AD.

Community Comment Notes

Community consensus strongly supports Option B, with users noting that the key phrase "continue to manage users... in the on-premises Active Directory" necessitates a trust relationship rather than a migration. One commenter highlighted that AWS Managed Microsoft AD acts as the bridge, allowing seamless authentication. Another user questioned why Option C was incorrect, emphasizing that Option C lacks the explicit connection to IAM Identity Center required for the SSO solution.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question requires SSO across AWS accounts but mandates keeping an on-premises identity source, look for solutions involving AWS IAM Identity Center integrated with AWS Managed Microsoft AD via a trust relationship. Avoid options that suggest migrating data or creating isolated directories if the goal is integration.

Frequently Asked Questions

Why not just create a trust in AWS Directory Service?

A simple trust (Option C) doesn't automatically make it the identity source for IAM Identity Center. You need the specific integration described in Option B.

Does AWS Managed Microsoft AD replace the on-prem AD?

No, it acts as a bridge. The two-way trust allows the cloud directory to validate users against the on-premises AD, preserving your existing management structure.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Kaula 👍 4 Answered B
    https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_setup_trust.html
  2. Scheldon 👍 2 Answered B
    AnswerB AWS Directory Service lets you run Microsoft Active Directory (AD) as a managed service. AWS Directory Service for Microsoft Active Directory, also referred to as AWS Managed Microsoft AD, is powered by Windows Server 2019. With AWS Managed Microsoft AD, you can run directory-aware workloads in the AWS Cloud, including Microsoft SharePoint and custom .NET and SQL Server-based applications. You can also configure a trust relationship between AWS Managed Microsoft AD in the AWS Cloud and your existing on-premises Microsoft Active Directory, providing users and groups with access to resources in either domain, using AWS IAM Identity Center. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html
  3. LeonSauveterre 👍 2 Answered B
    AWS IAM Identity Center (formerly AWS SSO): Provides SSO across multiple AWS accounts in an organization. By configuring a 2-way forest trust relationship between the on-premises AD and MAD, IAM Identity Center can integrate seamlessly with the existing AD to manage authentication and authorization, allowing the company to retain its existing on-premises AD as the primary identity source while extending to AWS. A - This creates a separate directory in AWS, requiring migration of users and groups, which fails to continue using the on-premises AD. C - IAM Identity Center is still needed for SSO (single sign-on) functionality. D - OK but so much overhead.
  4. EdricHoang 👍 2 Answered B
    "continue to manage users and groups that are in the on-premises Active Directory" I go for B
  5. haci 👍 2 Answered B
    Same with Q-28
Show 1 more comment
  1. LuongTo 👍 1
    why C is out?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide