A company migrates applications to AWS across multiple accounts managed with AWS Organizations. The security team needs single sign-on (SSO) across all accounts while continuing to manage users and groups in the on-premises self-managed Microsoft Active Directory. Which solution meets these requirements?

The correct solution is to enable AWS Single Sign-On (AWS SSO) and establish a two-way forest trust with the on-premises Microsoft Active Directory using AWS Directory Service for Microsoft Active Directory. AWS SSO provides centralized SSO across multiple AWS accounts in an AWS Organization. A two-way trust allows users authenticated in the on-premises AD to access resources in AWS, and also allows AWS Directory Service to query on-premises AD for user and group information, which is necessary for AWS SSO integration. A one-way trust would not allow AWS Directory Service to query the on-premises AD, preventing the necessary integration with AWS SSO. Simply using AWS Directory Service with a two-way trust without enabling AWS SSO would provide directory services but not the centralized SSO across multiple accounts that AWS SSO offers. Deploy