You are working for a company and have been allocated to ensure that there is a federated authentication mechanism setup between AWS and their On-premises Active Directory. Which of the following are important steps that need to be covered in this process? Choose 2 answers from the options given below.

Answer options:

A.Configure a proper regular expression (regex) matching between the on-premises AD group name and an AWS IAM role.
B.Configure a proper regular expression (regex) matching between the on-premises AD group name and an AWS IAM Group.
C.Configure AWS as the relying party in the AWS Identity Provider.
D.Configure AWS as the relying party in Active Directory Federation services.

Answer – A and D
The AWS Documentation mentions some key aspects with regards to the configuration of On-premises AD with AWS.
Active Directory Configuration:
Determining how you will create and delineate your AD groups and IAM roles in AWS is crucial to how you secure access to your account and manage resources. SAML assertions to the AWS environment and the respective IAM role access will be managed through regular expression (regex) matching between your on-premises AD group name to an AWS IAM role.
One approach for creating the AD groups that uniquely identify the AWS IAM role mapping is by selecting a common group naming convention. For example, your AD groups would start with an identifier, for example, AWS-, as this will distinguish your AWS groups from others within the organization. Next, include the 12-digit AWS account number. Finally, add the matching role name within the AWS account. Here is an example:
Active Directory Federation Services Configuration:
ADFS federation occurs with the participation of two parties; the identity or claims provider (in this case the owner of the identity repository – Active Directory) and the relying party, which is another application that wishes to outsource authentication to the identity provider; in this case Amazon Secure Token Service (STS). The relying party is a federation partner that is represented by a claims provider trust in the federation service.
Option B is incorrect because the AD group name should not be matched to an IAM Group.
Option C is incorrect because the relying party should be configured in Active Directory Federation services.
For more information on the federated access, please visit the following URL:
https://aws.amazon.com/blogs/security/aws-federated-authentication-with-active-directory-federation-services-ad-fs/