AWS IAM Identity Center with External IdP for Multi-Account Access

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Configure AWS IAM Identity Center (AWS Single Sign-On) to connect to the existing IdP and provision users and groups for access to the AWS accounts.

Question

A company sets up an organization in AWS Organizations that contains 10 AWS accounts. A solutions architect must design a solution to provide access to the accounts for several thousand employees. The company has an existing identity provider (IdP). The company wants to use the existing IdP for authentication to AWS. Which solution will meet these requirements?
  1. Create IAM users for the employees in the required AWS accounts. Connect IAM users to the existing IdP. Configure federated authentication for the IAM users.
  2. Set up AWS account root users with user email addresses and passwords that are synchronized from the existing IdP.
  3. Configure AWS IAM Identity Center (AWS Single Sign-On). Connect IAM Identity Center to the existing IdP. Provision users and groups from the existing IdP. Correct Answer
  4. Use AWS Resource Access Manager (AWS RAM) to share access to the AWS accounts with the users in the existing IdP.

Key Takeaways

The key insight is recognizing that IAM Identity Center natively supports provisioning users and groups from external identity providers, whereas standard IAM requires manual user creation or complex role trust relationships.

This question tests the correct method to federate access from an existing identity provider across multiple AWS accounts using AWS IAM Identity Center (formerly AWS Single Sign-On). It establishes that IAM Identity Center is the centralized solution for provisioning users and groups from external IdPs.

Common mistake: A common mistake is choosing to create IAM users directly in each account or trying to use AWS RAM for access management, neither of which supports direct federation with an external IdP for console/CLI access at scale.

Expert Analysis

Why the Answer Is Correct

Option C is the correct answer because AWS IAM Identity Center (formerly AWS Single Sign-On) is designed specifically for centralized access management across multiple AWS accounts and business applications. It allows you to connect your existing identity provider (IdP) as an identity source. Once connected, you can provision users and groups from your IdP into IAM Identity Center, and then assign permission sets (policies) to those users/groups across the desired AWS accounts. This meets the requirement of authenticating thousands of employees using their existing credentials while providing access to the organization's accounts.

Why the Other Options Are Wrong

Option A is incorrect because IAM does not support connecting IAM users directly to an external IdP for authentication. IAM users are standalone entities within AWS; while you can use IAM roles for federation, creating individual IAM users for thousands of employees is unmanageable and contradicts the goal of using the existing IdP for authentication. Option B is incorrect because root users cannot be synchronized or managed by an external IdP, and sharing root credentials is a severe security anti-pattern. Option D is incorrect because AWS Resource Access Manager (RAM) is used for sharing resources (like subnets, Transit Gateways, etc.) between AWS accounts, not for managing user identities or authentication.

Community Comment Notes

Community consensus strongly supports Option C. As noted by user osmk, IAM Identity Center redirects authentication to the external IdP and handles provisioning based on policies. Another commenter, ogerber, confirmed the official documentation link supporting this setup. The high vote count (100%) indicates clear agreement among learners that this is the standard best practice for multi-account federation.

Official Reference

https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html#provisioning-when-external-idp

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question mentions 'existing IdP', 'multiple AWS accounts', and 'thousands of employees', immediately consider AWS IAM Identity Center. It is the designated service for centralizing identity and access management across an organization using external identities.

Frequently Asked Questions

Why can't I just create IAM users and link them to my IdP?

IAM users are standalone AWS identities and cannot be linked directly to an external IdP for authentication. You must use IAM roles for federation or IAM Identity Center.

Does AWS RAM help with user authentication across accounts?

No, AWS RAM is for sharing AWS resources (like VPCs or RDS instances) between accounts, not for managing user identities or authentication.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. osmk 👍 8
    c--> Regardless of how you provision users, IAM Identity Center redirects the AWS Management Console, command line interface, and application authentication to your external IdP. IAM Identity Center then grants access to those resources based on policies you create in IAM Identity Center https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html#provisioning-when-external-idp
  2. ogerber 👍 4 Answered C
    Option C https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html
  3. osmk 👍 3 Answered C
    https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html#provisioning-when-external-idp
  4. Andy_09 👍 3
    Option C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide