Question
HOTSPOT -
A security engineer needs to implement AWS IAM Identity Center with an external identity provider (IdP).
Select and order the correct steps from the following list to meet this requirement. Select each step one time or not at all.
Configure the external IdP as the identity source in IAM Identity Center.
Create an IAM role that has a trust policy that specifics the IdP's API endpoint.
Enable automatic provisioning in IAM Identity Center settings
Enable automatic provisioning in the external IdP.
Obtain the SAML metadata from IAM Identity Center.
Obtain the SAML metadata from the external IdP.
Explanation
First, obtain the SAML metadata from IAM Identity Center (Service provider metadata); the external IdP needs it to trust IAM Identity Center. Next, configure the external IdP as the identity source in IAM Identity Center, uploading the IdP's own metadata file so IAM Identity Center trusts the IdP's SAML assertions. Finally, enable automatic provisioning in the IAM Identity Center settings, which provides the SCIM endpoint and access token the IdP uses to sync users and groups. An IAM role trust policy is not part of connecting an IdP to IAM Identity Center.
