Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 222 discussion

Integration with External IdP: IAM Identity Center supports SAML 2.0 and SCIM for seamless integration with external identity providers (e.g., Azure AD, Okta). Users authenticate via the corporate IdP and access AWS resources through the AWS access portal. Centralized Access Management: Permission Sets: Define roles (e.g., ReadOnly, Administrator) in the management account and assign them to users/groups from the external IdP. These sets apply across all AWS accounts in the organization. Account Assignments: Assign users/groups to specific AWS accounts with predefined permissions, eliminating per-account IAM role configuration. AWS Organizations Compatibility: When enabled in the management account, IAM Identity Center becomes the central hub for managing access across all member accounts

AWS IAM Identity Center (formerly AWS Single Sign-On): This service allows you to centrally manage access to multiple AWS accounts and applications. It integrates seamlessly with external IdPs, providing a unified identity management solution. Permission Sets and Account Assignments: IAM Identity Center enables you to create permission sets that define the permissions for users and groups. You can then assign these permission sets to users and groups across your AWS accounts, ensuring consistent access management. This approach provides a robust and scalable solution for managing user access and permissions across your AWS environment.

The best solution for integrating user management with an external identity provider (IdP) and centrally managing access to all AWS accounts and applications is B. Enable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center. AWS IAM Identity Center (formerly AWS Single Sign-On) allows you to connect your external IdP, such as Okta or Microsoft Entra ID, using SAML 2.0 or SCIM protocols1. This setup enables centralized management of user access across all AWS accounts and applications within your organization

Amazon Cognito is intended for managing access to user-facing applications, not for centralized management of AWS accounts and resources in an organization so D doesn't work.

D is more scalable