An enterprise is migrating its on-premises Active Directory (AD) to AWS. They want to use AWS IAM Identity Center (successor to AWS SSO) to manage access to their 100+ AWS accounts. They want to maintain their existing AD as the single source of truth for user identities and passwords. Which architecture provides the MOST reliable and lowest latency authentication experience?

Deploy AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) in a central VPC. Establish a two-way trust with the on-premises AD. Connect IAM Identity Center to the Managed AD.

Use AD Connector to connect IAM Identity Center directly to the on-premises AD over an AWS Site-to-Site VPN.

Configure IAM Identity Center to use its internal identity store. Write a script to synchronize users and passwords from on-premises AD daily.

Deploy an open-source SAML identity provider on EC2. Federate the on-premises AD to the SAML provider, and federate the SAML provider to IAM Identity Center.