A company is migrating applications from a self-managed on-premises Microsoft Active Directory to AWS. The applications run in multiple AWS accounts managed centrally with AWS Organizations. The security team needs single sign-on across all AWS accounts while continuing to manage users and groups in the on-premises Active Directory. Which solution meets these requirements?

The correct solution leverages AWS IAM Identity Center (successor to AWS SSO) for centralized single sign-on across multiple AWS accounts in AWS Organizations. By configuring a two-way forest trust between the on-premises Active Directory and AWS Directory Service for Microsoft Active Directory, users and groups managed on-premises can authenticate directly with IAM Identity Center. This allows the security team to maintain their existing user management while providing seamless access to AWS resources. Creating an Enterprise Edition Active Directory in AWS and making it the identity source would require migrating users and groups, which contradicts the requirement to continue managing them on-premises. Simply using AWS Directory Service and creating a two-way trust doesn't inherently provide single sign-on across all AWS accounts; IAM Identity Center is crucial for that. Deploying an IdP on EC2 is an unnecessary additional layer when AWS Directory Service and IAM Identity Center can directly integrate with on-premises AD.