CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS IAM — Identity & Access: When to Use What (and How the Exam Tests It)
Master AWS IAM for the SAA-C03 exam. Learn about users, roles, policies, and how to apply them effectively.
Identity is the new perimeter. In today’s cloud environment, managing who has access to resources is crucial. AWS Identity and Access Management (IAM) provides the tools to control access to AWS services and resources securely. This guide outlines when to use specific IAM features and how the exam tests these concepts.
Understanding IAM Components
IAM includes users, groups, roles, and policies. Each component plays a role in determining access permissions:
- Users: Individual accounts for people or services.
- Groups: Collections of users that share permissions.
- Roles: Temporary access for users or services that need permissions without long-lived credentials.
- Policies: JSON documents defining permissions.
When to Use What
Understanding when to use users, groups, roles, and policies is key for effective IAM management. Here’s a breakdown:
| Component | Use Case | Key Features |
|---|---|---|
| Users | Individual access | Permanent credentials, direct permissions |
| Groups | Bulk permission management | Assign policies to multiple users |
| Roles | Temporary access for services/users | No long-lived keys, assumed by users/services |
| Policies | Define permissions | Control access, can be attached to users, groups, or roles |
Roles Over Users
Always prefer roles with temporary credentials over long-lived user keys. Roles provide more security and are easier to manage. For example, an EC2 instance accesses AWS services via an attached role, eliminating the need for stored access keys.
Cross-Account Access
For cross-account access, create a role in the target account that the source account can assume via AWS Security Token Service (STS). This method allows secure access without sharing long-lived credentials.
Service Control Policies (SCP)
SCPs set organization-wide guardrails. They establish the maximum permissions allowed for accounts in an AWS Organization. Even if a user has an IAM allow policy, they can be denied by an SCP. Always remember: SCPs set the ceiling for access.
How the Exam Tests This
The SAA-C03 exam tests your IAM knowledge in specific ways. Here are common patterns:
- Explicit Deny: Questions often emphasize that an explicit deny always takes precedence over any allow. Be ready to identify scenarios where this applies.
- SCP Limitations: Expect questions that require you to recognize how SCPs can restrict access, even when an IAM policy seems to allow it. Pay attention to the wording.
- Temporary Access: You might encounter scenarios asking how to grant temporary access without static credentials. The answer is always an IAM role combined with STS.
The Rule to Remember
Explicit deny always wins. Use roles for temporary access, and remember SCPs can restrict permissions regardless of IAM policies.
Managing IAM effectively is crucial for security in cloud environments. Make sure to practice these concepts to excel in the SAA-C03 exam.