A company uses AWS IAM Identity Center with SAML 2.0 federation. The company decides to change its federation source from one identity provider (IdP)…

When changing the external identity provider (IdP) for AWS IAM Identity Center, the primary task is to update the identity source configuration. Since the new IdP may use different attribute names in its SAML assertion compared to the old one (even if both use the same underlying Active Directory), the attribute mappings within IAM Identity Center must be modified. These mappings tell IAM Identity Center how to interpret incoming user information, such as username and email, from the SAML assertion sent by the new IdP. This ensures that federated users are correctly identified and authorized.

A. Disabling users is a disruptive and incorrect step. Since the underlying directory is the same, the user identities persist; only the authentication source is changing.

C. IAM roles managed by IAM Identity Center trust the IAM Identity Center service principal, not the external IdP directly. This trust relationship does not need to be changed.

D. While correct clock synchronization (NTP) is a prerequisite for any SAML federation to function, it is a general operational requirement, not the specific configuration step for migrating between IdPs.

1. AWS IAM Identity Center User Guide, "Manage your identity source": This section details the process of configuring an external IdP. It states, "When you change your identity source, you must reconfigure the settings for that source. For example, if you change from one external IdP to another, you must provide the new IdP metadata and reconfigure attribute mappings." This directly supports updating the mappings as the core action.

2. AWS IAM Identity Center User Guide, "Attribute mappings": This page explains that you must configure attribute mappings in IAM Identity Center to match the attributes from your IdP. It explicitly lists attributes like Subject, email, and name that must be mapped from the IdP's assertion, confirming that this is a critical configuration step when connecting any IdP.

3. AWS IAM Identity Center User Guide, "How permission sets work": This documentation explains that IAM Identity Center creates IAM roles in AWS accounts and that the trust policy for these roles allows principals authenticated by IAM Identity Center to assume them. The trust is with IAM Identity Center, not the external IdP, which invalidates option C.