A company needs to use its on-premises LDAP directory service to authenticate its users to...

The correct answer isDbecause the company needs to authenticate users from anon-premises LDAP directoryto theAWS Management Console, but the directory isnot SAML-compatible. In this scenario, the AWS-recommended pattern is to use acustom identity brokerthat authenticates users against the existing LDAP directory and then requeststemporary AWS credentialsfromAWS Security Token Service (AWS STS). This enables federated access to AWS without creating long-term IAM user credentials for each person.

A custom identity broker serves as the intermediary between the non-SAML directory and AWS. After validating a user with LDAP, the broker can call AWS STS to issue short-lived credentials or console sign-in access. This approach preserves the use of the company’s existing identity source while meeting AWS security best practices for temporary credentials and centralized identity management.

Option A is incorrect becauseAWS IAM Identity Centertypically relies on supported identity sources and federation methods, and the question explicitly states that the LDAP directory is not SAML-compatible. Option B is incorrect because IAM policies do not integrate directly into LDAP as an authentication mechanism. Option C is incorrect because rotating IAM credentials tied to LDAP changes still relies on long-term credentials and does not provide a proper federated sign-in model.

AWS federation guidance supports the use of acustom identity brokerwhen an organization has a non-SAML-compatible identity system. Therefore, the best solution is to develop anon-premises custom identity brokerthat usesAWS STSto obtain short-lived credentials for AWS Management Console access.