A 2,000-person healthcare company uses a corporate SAML identity provider, needs centralized AWS console and CLI access with job-function permission sets, automated provisioning and deprovisioning, and MFA enforced by the IdP. Local IAM users create sprawl. Which identity solution centralizes human authentication with federated single sign-on for the organization?
Select an answer to reveal the explanation.
Short Explanation
You've cut through the workforce versus customer identity maze nicely. IAM Identity Center is your HR front desk for staff access, giving one federated doorway with permission sets mapped to roles.
Full Explanation
AWS IAM Identity Center provides centralized workforce identity for human access to AWS accounts and applications, integrating with an external SAML identity provider for single sign-on, MFA enforcement, and lifecycle provisioning while assigning permission sets that map to job functions. Amazon Cognito user pools serve customer-facing application authentication rather than centralized AWS console and CLI workforce access across an organization, lacking permission set management for accounts. Creating IAM users per account reintroduces credential sprawl and manual provisioning, contradicting the centralization and automated joiner and mover requirements. Cognito identity pools federate identities to grant temporary access to AWS resources for app users, not to broker workforce console access with organization-wide permission sets. For the exam, distinguish Identity Center for workforce and Cognito for customer apps, and in practice verify IdP attribute mappings and permission set assignments in a test OU first.