A 2,000-employee retailer uses Entra ID for corporate logins and Workday as HR source, and must give AWS console and CLI access with automatic joiner-mover-leaver provisioning and no long-term IAM users. Which identity federation design using standard protocols centralizes workforce access and lifecycle?
Select an answer to reveal the explanation.
Short Explanation
Hiring never stops, so your access shouldn't need manual tickets. SCIM provisioning keeps Identity Center in sync with HR changes automatically. It's like payroll updating building badges overnight.
Full Explanation
The correct design uses IAM Identity Center as the workforce portal integrated to the external IdP via SAML 2.0 for authentication and SCIM for automated provisioning, which satisfies centralized console and CLI access via short-lived credentials plus true joiner-mover-leaver lifecycle without IAM users. Using OIDC with manual CSV imports provides federation for sign-in but replaces SCIM automation with periodic batch uploads that miss immediate deprovisioning and violate the automatic lifecycle fact. Cognito user pools federate customers and app users via SAML or OIDC and issue app tokens, but they do not broker multi-account AWS management access with permission sets, so this approach misapplies workforce versus customer identity domains. Per-account AD Connector with IAM users retains long-lived users and per-account mappings that increase operational overhead and contradict the no-IAM-users and centralization requirements. For the exam, remember Identity Center plus SAML plus SCIM is the workforce pattern, while Cognito is the app-user pattern, and in practice confirm attribute mappings, group-to-permission-set assignments and SCIM token rotation.