Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 231 discussion

Use AWS IAM Identity Center to configure identity federation with SAML 2.0: Configure SAML-based federation between your corporate IdP and AWS IAM. This allows users to authenticate via your corporate identity provider when accessing the AWS Management Console. Create a permissions boundary in AWS IAM Identity Center: Set up a permissions boundary to deny password logins for IAM users. This ensures that users must authenticate through the corporate IdP rather than using IAM user credentials.

Option B: Configure identity federation with SAML 2.0 using AWS IAM Identity Center. Option E: Implement an SCP to deny password creation for IAM users, enforcing IdP authentication. Incorrect for C - Permissions Boundaries - Permissions boundaries in AWS IAM Identity Center define the maximum permissions an IAM entity can have but are not used to control login methods or deny password logins. - Permissions boundaries do not restrict authentication methods or enforce federation. - Permissions boundaries are not applicable for denying IAM user logins.

---> BE

of course B. E enforce that users cannot log in directly with IAM credentials. Instead, they must use the SSO setup provided by AWS IAM Identity Center, ensuring compliance with the requirement to authenticate through the corporate IdP.

BE is answer { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "iam:CreateLoginProfile", "iam:UpdateLoginProfile" ], "Resource": "*" } ] }