Question

A large enterprise has adopted AWS Organizations with IAM Identity Center for workforce access across 40 member accounts. The company's HR system is the source of truth for employees and uses Okta as its corporate identity provider. Security requires that when an employee changes departments or leaves the company, their AWS access is automatically updated or revoked without any manual action by cloud administrators. Group memberships defined in Okta must drive which permission sets users receive. Which approach meets these requirements with the least ongoing operational overhead?

Accepted Answer

Configure Okta as an external SAML 2.0 identity provider in IAM Identity Center and enable automatic provisioning using SCIM, then assign permission sets to synchronized groups.

Answer

Configure Okta as a SAML 2.0 identity provider in IAM Identity Center and have administrators manually create matching users and groups in the Identity Center identity store each time HR reports a change.

Answer

Create SAML federation directly in IAM in each of the 40 member accounts, trusting Okta, and map Okta attributes to IAM roles per account.

Answer

Synchronize Okta users into an AWS Managed Microsoft AD directory connected to IAM Identity Center, and rely on scheduled Lambda functions to deprovision departed users.