A large IT organization uses LDAP groups to control on-premises access and wants to migrate to AWS without giving everyone broad access. What is the most appropriate way to allow users to sign in with existing LDAP credentials while granting different permissions based on job function?

Federating on-premises LDAP with IAM using SAML is the most appropriate solution. This allows users to authenticate with their existing LDAP credentials, providing a seamless single sign-on experience. By mapping LDAP groups to specific IAM roles, you can grant different permissions based on job function, ensuring the principle of least privilege. Deploying Simple AD and replicating the directory is less efficient as it duplicates directory management. Building a Lambda to provision IAM users and policies is overly complex and introduces potential synchronization issues. Using CloudFormation and Direct Connect to query LDAP directly from AWS is for network connectivity, not identity federation, and doesn't directly address mapping LDAP groups to IAM roles for permission management.