Least Overhead Identity Integration with On-Prem AD

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Use AD Connector to connect to the on-premises Active Directory and integrate it with AWS IAM Identity Center for centralized access management.

Question

A company needs to give a globally distributed development team secure access to the company's AWS resources in a way that complies with security policies. The company currently uses an on-premises Active Directory for internal authentication. The company uses AWS Organizations to manage multiple AWS accounts that support multiple projects. The company needs a solution to integrate with the existing infrastructure to provide centralized identity management and access control. Which solution will meet these requirements with the LEAST operational overhead?
  1. Set up AWS Directory Service to create an AWS managed Microsoft Active Directory on AWS. Establish a trust relationship with the on-premises Active Directory. Use IAM rotes that are assigned to Active Directory groups to access AWS resources within the company's AWS accounts.
  2. Create an IAM user for each developer. Manually manage permissions for each IAM user based on each user's involvement with each project. Enforce multi-factor authentication (MFA) as an additional layer of security.
  3. Use AD Connector in AWS Directory Service to connect to the on-premises Active Directory. Integrate AD Connector with AWS IAM Identity Center. Configure permissions sets to give each AD group access to specific AWS accounts and resources. Correct Answer
  4. Use Amazon Cognito to deploy an identity federation solution. Integrate the identity federation solution with the on-premises Active Directory. Use Amazon Cognito to provide access tokens for developers to access AWS accounts and resources.

Key Takeaways

The exam tests your ability to distinguish between directory replication (Managed Microsoft AD) and proxy authentication (AD Connector), with the trap being the assumption that Managed AD is always superior despite higher maintenance costs.

This question evaluates the optimal method for integrating on-premises Active Directory with AWS Organizations to provide centralized identity management. The correct solution leverages AD Connector and IAM Identity Center to minimize operational overhead while maintaining security policies.

Common mistake: Many candidates choose Option A (AWS Managed Microsoft AD) because it offers full directory features, but they overlook the significant operational overhead of managing a separate directory instance and synchronizing users, which violates the 'least operational overhead' requirement.

Expert Analysis

Why the Answer Is Correct

Option C is the correct answer because it uses AD Connector, which acts as a proxy to authenticate users against the on-premises Active Directory without replicating or storing any directory data in AWS. This eliminates the need for user provisioning/deprovisioning tasks within AWS. By integrating AD Connector with AWS IAM Identity Center (formerly SSO), the company can centrally manage access across multiple AWS accounts using existing AD groups and permissions sets, perfectly aligning with the requirements for centralized control and minimal overhead.

Why the Other Options Are Wrong

Option A (AWS Managed Microsoft AD) requires creating and maintaining a new directory infrastructure in AWS, including synchronization with on-premises AD, which introduces significantly higher operational overhead than a simple proxy connection. Option B (IAM Users) is entirely manual and does not integrate with existing identity sources, making it unscalable and non-compliant with centralized policy requirements. Option D (Amazon Cognito) is primarily designed for customer-facing applications (B2C) rather than internal enterprise developer access, and integrating it with on-premises AD for this specific use case is more complex and less standard than using IAM Identity Center.

Community Comment Notes

Community consensus strongly favors Option C, noting that "AD Connector seamlessly connects AWS to the on-premises Active Directory without the need to synchronize or replicate the directory." One commenter highlighted that Managed AD involves "Higher Overhead" due to the separate instance maintenance. Another noted that once set up, the AD Connector solution "requires minimal ongoing management" as user lifecycle events are handled by existing AD processes.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see 'least operational overhead' combined with 'existing on-premises Active Directory', look for solutions that avoid data replication or synchronization. AD Connector + IAM Identity Center is the standard pattern for this scenario in the SAA-C03 exam.

Frequently Asked Questions

Why not use AWS Managed Microsoft AD?

Managed AD requires replicating directory data and managing a separate Windows Server instance, which creates high operational overhead compared to the lightweight AD Connector proxy.

Can AD Connector be used with IAM Identity Center?

Yes, AD Connector serves as an identity source for IAM Identity Center, allowing you to map on-premises AD groups to AWS permissions sets across multiple accounts.

More SAA-C03 FAQ →

Community Votes

C
79%
A
21%

79% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. LeonSauveterre 👍 3 Answered C
    A - On-premises Active Directory already exists. B - "Manually" ? Oh hell no. But MFA is something I guess. C - AD Connector seamlessly connects AWS to the on-premises Active Directory without the need to synchronize or replicate the directory. Identity Center (formerly AWS SSO) allows centralized access management across AWS accounts in an AWS Organizations setup. Permissions sets can be configured to map Active Directory groups to specific AWS accounts and resources, making access control easy and secure. D - Amazon Cognito is better suited for application-level identity management (like customer-facing apps), not for internal teams working across multiple AWS accounts.
  2. GOTJ 👍 3 Answered A
    Why not "A"? Check out the note of this link: https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_ad_connector.html AD Connector cannot be shared with other AWS accounts. If this is a requirement, consider using AWS Managed Microsoft AD to Share your AWS Managed Microsoft AD. AD Connector is also not multi-VPC aware, which means that AWS applications like WorkSpaces are required to be provisioned into the same VPC as your AD Connector. And I think managing multiple aws accounts is, indeed, a requirement
  3. trinh_le 👍 2 Answered C
    C: AD Connector allows AWS to use the on-premises Active Directory for authentication without replicating directory data to AWS. • Maintains centralized identity management in the on-premises directory, adhering to the company’s security policies. A: Higher Overhead: Requires creating and maintaining a separate managed Active Directory instance in AWS. B: Scalability Issues: Manually creating and managing IAM users for a globally distributed team is cumbersome. D: Unnecessary Federation Layer: Cognito is more suited for customer identity use cases rather than managing internal developer access to AWS resources.
  4. 78b9037 👍 2 Answered C
    Once set up, it requires minimal ongoing management. User provisioning and deprovisioning are handled through the existing Active Directory.processes.
  5. aragon_saa 👍 2 Answered C
    Answer is C
Show 1 more comment
  1. xekiva3329 👍 2 Answered C
    answer C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide