What is the MOST operationally efficient solution that meets these requirements?
Create a Simple AD domain, and establish a forest trust relationship with the on-premises Active Directory domain. Set the Simple AD domain as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
Create an Active Directory domain controller on an Amazon EC2 instance that is joined to the on-premises Active Directory domain. Set the Active Directory domain controller as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
Create an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
Use the built-in SSO directory as the identity source for IAM Identity Center. Copy the users and groups from the on-premises Active Directory domain. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.
Explanations:
Creating a Simple AD domain and establishing a forest trust would require significant management overhead and complexity. Additionally, AWS IAM Identity Center does not support using Simple AD as an identity source directly, making it less operationally efficient.
Setting up an Active Directory domain controller on an EC2 instance adds unnecessary complexity and operational overhead. This approach requires ongoing maintenance of the EC2 instance and does not provide the integration benefits that AWS AD Connector offers.
Creating an AD Connector provides a seamless integration with the on-premises Active Directory environment, allowing for centralized user and permission management with minimal operational overhead. It efficiently uses IAM Identity Center to manage user access across AWS accounts.
Using the built-in SSO directory requires duplicating users and groups from the on-premises Active Directory, leading to potential synchronization issues and increased administrative effort. It is not the most efficient solution compared to using AD Connector.
Based on what I know, the answer is:
Create an AD Connector that is associated with the on-premises Active Directory domain. Set the AD Connector as the identity source for IAM Identity Center. Create the required role-based permission sets. Assign each group of users to the AWS accounts that the group will manage.