Which strategy should the solutions architect use for end user authentication?
Create an AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) directory within the WorkSpaces VPC. Use the Active Directory Migration Tool (ADMT) with the Password Export Server to copy users from the on-premises Active Directory to AWS Managed Microsoft AD. Set up a one- way trust allowing users from AWS Managed Microsoft AD to access resources in the on-premises Active Directory. Use AWS Managed Microsoft AD as the directory for WorkSpaces.
Create a service account in the on-premises Active Directory with the required permissions. Create an AD Connector in AWS Directory Service to be deployed on premises using the service account to communicate with the on-premises Active Directory. Ensure the required TCP ports are open from the WorkSpaces VPC to the on-premises AD Connector. Use the AD Connector as the directory for WorkSpaces.
Create a service account in the on-premises Active Directory with the required permissions. Create an AD Connector in AWS Directory Service within the WorkSpaces VPC using the service account to communicate with the on-premises Active Directory. Use the AD Connector as the directory for WorkSpaces.
Create an AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) directory in the AWS Directory Service within the WorkSpaces VPC. Set up a one-way trust allowing users from the on-premises Active Directory to access resources in the AWS Managed Microsoft AD. Use AWS Managed Microsoft AD as the directory for WorkSpaces. Create an identity provider with AWS Identity and Access Management (IAM) from an on-premises ADFS server. Allow users from this identity provider to assume a role with a policy allowing them to run WorkSpaces.
Explanations:
This option suggests copying AD users to AWS Managed Microsoft AD, but this violates the requirement to avoid storing credentials outside the company. A one-way trust also wouldn’t allow AD credentials to remain solely on-premises.
Deploying the AD Connector on-premises with a service account isn’t supported by AWS, as AD Connectors must be in AWS, not on-premises. This setup also complicates direct communication with on-prem AD for SSO.
Deploying an AD Connector within the WorkSpaces VPC enables direct authentication against on-prem AD without storing credentials in AWS. This meets all requirements, including SSO and secure AD integration via Direct Connect.
Using AWS Managed Microsoft AD with ADFS does not meet the requirement to avoid external credential storage and would complicate SSO with on-prem AD, requiring additional configuration for seamless integration.
To the best of my knowledge, the answer is:
Create a service account in the on-premises Active Directory with the required permissions. Create an AD Connector in AWS Directory Service within the WorkSpaces VPC using the service account to communicate with the on-premises Active Directory. Use the AD Connector as the directory for WorkSpaces.