Which combination of actions should a solutions architect recommend to meet these requirements?
(Choose two.)
Create a new organization in AWS Organizations with all features turned on. Create the new AWS accounts in the organization.
Set up an Amazon Cognito identity pool. Configure AWS Single Sign-On to accept Amazon Cognito authentication.
Configure a service control policy (SCP) to manage the AWS accounts. Add AWS Single Sign-On to AWS Directory Service.
Create a new organization in AWS Organizations. Configure the organization’s authentication mechanism to use AWS Directory Service directly.
Set up AWS Single Sign-On (AWS SSO) in the organization. Configure AWS SSO, and integrate it with the company’s corporate directory service.
Explanations:
Creating a new organization in AWS Organizations allows for centralized management of multiple AWS accounts. Enabling all features ensures that the organization can utilize consolidated billing, service control policies, and other advanced features, which is essential for a multi-account architecture.
Amazon Cognito is primarily used for user authentication and does not directly integrate with AWS Organizations for managing AWS account access. AWS Single Sign-On (AWS SSO) is a more appropriate service for federating access to multiple AWS accounts from a centralized corporate directory.
While service control policies (SCPs) are useful for managing permissions across AWS accounts, AWS Single Sign-On (AWS SSO) should be integrated with the corporate directory service directly, rather than being added to AWS Directory Service. This option does not correctly outline the use of AWS SSO in conjunction with centralized authentication.
While creating an organization in AWS Organizations is correct, AWS Directory Service does not directly serve as an authentication mechanism for AWS Organizations. Instead, AWS SSO should be used for centralized user authentication across accounts. This option misrepresents the proper integration of directory services.
Setting up AWS Single Sign-On (AWS SSO) within the organization allows for centralized access management across AWS accounts. Integrating AWS SSO with the corporate directory service facilitates federated authentication, enabling users to access multiple AWS accounts with a single set of credentials.
As far as I’m aware, the answer is:
Create a new organization in AWS Organizations with all features turned on. Create the new AWS accounts in the organization.
I have a feeling that the answer is:
Create a new organization in AWS Organizations with all features turned on. Create the new AWS accounts in the organization.