The company uses an on-premises Active Directory for authentication and wants employees to sign in to all AWS accounts in an AWS Organizations setup using the same identities. Site-to-Site VPN already connects the on-premises network to every AWS account. Company policy requires conditional access based on AD groups and roles, and all user identities must be managed in a single place. Which approach satisfies these requirements?

The correct option leverages AWS IAM Identity Center (formerly AWS Single Sign-On) to meet all requirements. Federating with Active Directory via SAML 2.0 allows employees to use existing AD identities. SCIM v2.0 ensures automatic synchronization of users and groups from AD to IAM Identity Center, maintaining a single source of truth for identities. ABAC enables conditional access based on AD group membership and roles, aligning with company policy. IAM Identity Center simplifies access management across multiple AWS accounts within an AWS Organizations setup. The second option is incorrect because it uses IAM Identity Center as the identity source, not the on-premises Active Directory. The third and fourth options are incorrect because they involve configuring IAM in a single account and then using cross-account access, which is more complex to manage across an entire organization compared to IAM Identity Center. They also don't inherently provide the centralized identity management and automatic provisioning capabilities of IAM Identity Center with SCIM.