Question

A financial services company runs 40 AWS accounts under AWS Organizations. Today, engineers authenticate against the company's corporate Active Directory and assume IAM roles in individual accounts using manually distributed cross-account role ARNs and long-lived SAML metadata configured separately in each account's IAM SAML identity provider. Adding a new account requires the security team to manually create SAML providers and roles in it, and offboarding a departing employee requires editing trust policies across many accounts. The company wants to centralize federated console and CLI access, automatically extend access to newly provisioned accounts, and manage user-to-account-to-permission assignments in one place while keeping Active Directory as the source of truth. Which approach best meets these requirements with the least ongoing operational overhead?

Accepted Answer

Deploy AWS IAM Identity Center in the management account (or a delegated administrator account), connect it to Active Directory via AWS Managed Microsoft AD with a two-way trust or the AD Connector, define permission sets, and assign groups to accounts centrally.

Answer

Create a single centralized identity account containing IAM users for every employee, and configure cross-account roles in each member account that trust that identity account, updating trust policies with automation whenever accounts are added.

Answer

Configure a SAML 2.0 identity provider and federation roles in each account using CloudFormation StackSets, and distribute per-account role ARNs to engineers through a self-service portal.

Answer

Use Amazon Cognito user pools federated with Active Directory to issue temporary credentials, and map Cognito groups to IAM roles in each of the 40 accounts.