How should the Security Engineer implement employee-only access to this system without changing the application?
Place the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the ALB. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.
Implement AWS SSO in the master account and link it to ADFS as an identity provider. Define the EC2 instance as a managed resource, then apply an IAM policy on the resource.
Define an Amazon Cognito identity pool, then install the connector on the Active Directory server. Use the Amazon Cognito SDK on the application instance to authenticate the employees using their Active Directory user names and passwords.
Create an AWS Lambda custom authorizer as the authenticator for a reverse proxy on Amazon EC2. Ensure the security group on Amazon EC2 only allows access from the Lambda function.
Explanations:
Placing the application behind an Application Load Balancer (ALB) allows for centralized access management. By using Amazon Cognito with SAML to connect to ADFS, the ALB can authenticate users before they access the application, effectively implementing employee-only access without modifying the legacy application.
While AWS SSO can integrate with ADFS, defining the EC2 instance as a managed resource and applying an IAM policy does not directly restrict access to the web application itself, as IAM policies are primarily for AWS resources rather than application-level access.
Although defining an Amazon Cognito identity pool can provide authentication, using the Amazon Cognito SDK directly on the application instance is not a viable option without modifying the legacy application to integrate the SDK, which is not allowed in this scenario.
Creating a Lambda custom authorizer for a reverse proxy would require implementing a proxy layer, which is not specified in the requirement. Furthermore, ensuring access control only through the Lambda function could complicate the architecture and does not directly secure the application without modifying its access methods.
It appears that the answer is:
Place the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the ALB. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.