Question

A company has grown to 40 AWS accounts managed under AWS Organizations. Employees currently have separate IAM users in several accounts, and administrators are struggling to manage credentials and enforce consistent permissions. The company already uses an external Microsoft Active Directory as its corporate identity source and wants employees to sign in once with their existing corporate credentials, then access only the accounts and roles appropriate to their job function. Which approach best meets these requirements with the least ongoing administrative effort?

Accepted Answer

Enable AWS IAM Identity Center, connect it to the corporate Active Directory as the identity source, and assign permission sets to groups across the organization's accounts.

Answer

Create identical IAM users and groups in each account and instruct employees to memorize a different password per account.

Answer

Configure a SAML 2.0 identity provider directly in each of the 40 accounts and manually create IAM roles trusting that provider in every account.

Answer

Create a single shared IAM user with programmatic access keys stored in AWS Secrets Manager and distribute the keys to all employees.