Your fortune 500 company has undertaken a TCO analysis evaluating the use of Amazon S3 versus acquiring more hardware. The outcome was that all employees would be granted access to use Amazon S3 for storage of their personal documents. Which of the following will you need to consider so that you can set up a solution that incorporates a single sign-on from your corporate AD or LDAP directory?

Answer options:

A.Setting up a federation proxy or identity provider.
B.Using AWS Security Token Service to generate temporary tokens.
C.Tagging each folder in the bucket.
D.Configuring IAM roles that have suitable permissions to the related S3 resources.
E.Setting up a matching IAM user for every user in your corporate directory that needs access to a folder in the bucket.

Answer – A, B, and D
In questions like this where an application or user needs to be given access using Single Sign On (SSO), the following steps are very important.
(i) setting up an identity provider for federated access
(ii) authenticating users using corporate data store or active directory-user-attributes.
(iii) getting temporary access tokens/credentials using AWS STS
(iv) creating the IAM Role that has access to the needed AWS Resources
Option A is CORRECT because as mentioned above, setting up an identity provider for federated access is needed.
Option B is CORRECT because as mentioned above, getting temporary access tokens/credentials using AWS STS is needed.
Option C is incorrect because tagging each folder in a bucket does not help in this scenario.
Option D is CORRECT because as mentioned above, creating the IAM Role that has access to the needed AWS Resources is needed.
Option E is incorrect because you should be creating IAM Roles rather than IAM Users. 
The diagram below showcases how authentication is carried out when having an identity broker. This is an example of a SAML connection, but the same concept holds true for getting access to an AWS resource.
For more information on federated access, please visit the below link-
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html