6 Identity and Access Management · AWS Cloud Practitioner

In this chapter you will learn who can do what in an AWS account and how AWS decides. We start with the root user and the tasks only it can perform, then build up the AWS Identity and Access Management (IAM) toolkit: users, groups, roles, and policies. You will read a real JSON policy line by line, see how AWS evaluates allow and deny statements, and learn the credential hygiene the exam expects (MFA, access keys, password policies, credential reports). We then step up to the multi-account world with IAM Identity Center, AWS Organizations, service control policies, AWS Control Tower, and AWS Resource Access Manager, and finish with Amazon Cognito and AWS Directory Service. This chapter maps to Domain 2 (Security and Compliance), Task Statement 2.2: “Understand AWS Cloud security, governance, and compliance concepts” and especially Task Statement 2.3: “Identify AWS access management capabilities.”

6.1 Why identity comes first

Picture an office building. The walls, locks, and cameras matter, but the most important security decision is who receives a key card and which doors that card opens. In AWS, identity plays the role of the key card. Every request to AWS, whether it comes from a person clicking in the console, a script using the command line, or an application calling an API, is checked against an identity and a set of permissions before anything happens.

Under the shared responsibility model (Chapter 5), AWS secures the infrastructure that IAM runs on, but you are responsible for how you configure it: who has access, which permissions they hold, and how well their credentials are protected. Many real-world cloud breaches trace back not to clever attacks on AWS but to leaked access keys, missing multi-factor authentication, or permissions that were far broader than needed. That is why the exam spends so much time here.

Two words are worth separating before we go further:

Authentication answers “Who are you?” It is proven with a password, an access key, an MFA code, or a token from an identity provider.

Authorization answers “What are you allowed to do?” It is decided by policies.

IAM handles both. It is a global service (you do not pick a Region for it), and it is offered at no additional charge. You pay only for the other AWS resources your users create.

6.2 The root user

When you create an AWS account, you sign up with an email address and a password. That combination becomes the root user: a single identity with complete, unrestricted access to every service and resource in the account, including billing. IAM policies in the account cannot limit the root user. (Service control policies from AWS Organizations, covered later, can restrict root in member accounts, but not in the management account.)

Because the root user is so powerful, AWS’s guidance is simple: use it only for the handful of tasks that require it, and lock it away for everything else.

Protecting the root user

Turn on multi-factor authentication (MFA) for the root user immediately. AWS now requires MFA for root user sign-in on most accounts, but you should verify it yourself.

Do not create access keys for the root user. If any exist, delete them.

Use a strong, unique password, and an email address that belongs to a group mailbox or distribution list rather than one person’s inbox, so the account is not lost when someone leaves the company.

Create an administrative identity (an IAM Identity Center user or, for a single small account, an IAM user) for daily administration.

In organizations with many accounts, the management account can use centralized root access management to remove root credentials from member accounts entirely and perform the rare root-only actions centrally.

Tasks that require the root user

Memorize the flavor of this list rather than every word. The pattern is: account-level ownership changes, billing and support contract changes, and a few recovery situations.

Root-only task Why it is root-only
Changeaccount name, root email, or root password Ownership of theaccount itself
Close the AWS account Irreversibleaccount-level action
Change or cancel the AWS Support plan Contract with AWS
Activate IAM access to the Billing console Opens billing to other identities
Restore IAM user permissions Recovery ifadmins lock themselves out

Registerasaseller in the EC2 Reserved Instance Marketplace Financial seller registration Configure MFA delete on an S3 bucket Protects versioned datafrom deletion

Unlock an S3 bucket policy that denies everyone Recovery from aself-lockout

Exam tip

If a question asks which identity must be used to change the support plan, close the account, or change the account’s email address, the answer is the root user. If it asks how to perform everyday administration, the answer is never the root user.

6.3 IAM building blocks

IAM gives you four core concepts. Three are identities (things that can act) and one is the rulebook. IAM entities inside one AWS account

Figure 6.1: The IAM entity hierarchy. An account contains the root user plus IAM users, groups, and roles; policies attach to users, groups, and roles to grant permissions.

IAM users

An IAM user represents one person or one workload that needs long-term credentials. A user can have: A console password for signing in to the AWS Management Console.

Up to two access keys (an access key ID plus a secret access key) for the AWS CLI, SDKs, and direct API calls. One or more MFA devices.

A new IAM user has no permissions at all. Until you attach a policy, directly or through a group, the user can sign in but cannot do anything. This “deny by default” behavior is a key exam concept.

Today AWS recommends that human users sign in through IAM Identity Center with temporary credentials rather than as individual IAM users. IAM users are still valid and still tested, especially for small accounts, emergency “break-glass” access, and workloads that genuinely cannot use roles.

IAM groups

An IAM group is a collection of IAM users. You attach policies to the group, and every member inherits them. Groups make administration manageable: rather than attaching the same five policies to forty developers, you attach them once to a Developers group and add or remove people as they join or leave.

Know three facts about groups:

1. A user can belong to multiple groups (for example, Developers and OnCall ).
2. Groups cannot contain other groups. There is no nesting.
3. A group is not an identity that can sign in or be named as a principal in a resource policy. It is purely a way to assign permissions to users.

IAM roles

An IAM role is an identity with permissions, but without long-term credentials. Nobody “is” a role; instead, a trusted entity assumes the role and receives temporary security credentials that expire automatically, typically after an hour (configurable from 15 minutes up to 12 hours depending on how the role is used).

Temporary credentials are issued by the AWS Security Token Service (AWS STS). Because they expire, a leaked temporary credential is far less dangerous than a leaked access key that lives forever.

Every role has two parts:

A trust policy that says who may assume the role (an AWS service such as EC2 or Lambda, another AWS account, a federated identity provider, or IAM users).

A permissions policy that says what the role can do once assumed.

Common uses for roles:

AWS services acting on your behalf. An EC2 instance that writes to Amazon S3, or a Lambda function that reads from DynamoDB, uses a role. You never store access keys on the server.

Cross-account access. A user in Account A assumes a role in Account B to do work there.

Federation. Users who sign in through a corporate identity provider (Microsoft Entra ID, Okta, Active Directory) are mapped to roles. IAM Identity Center uses roles behind the scenes.

Temporary elevated access. An engineer normally has read-only access, then assumes an admin role for a specific change.

Aws sdk

IAM role
Trust: ec2.amazonaws.com
Permissions: s3:PutObject
on bucket app-uploads

Aws sts

Issues temporary keys
+ session token
Amazon S3
app-uploads

1. Request role credentials
2. Temporary credentials

(expire, auto-refreshed)

checks role

3. App calls S3 with the temporary credentials; IAM evaluates the role's policy

Figure 6.2: How an EC2 instance uses a role. The instance profile lets the instance obtain temporary credentials from AWS STS, which the

application uses to call Amazon S3. No access keys are stored on the server.

Common trap

An answer option that says “store an IAM user’s access keys on the EC2 instance” or “embed access keys in the application code” is always wrong when an IAM role is available. Roles for EC2 (attached through an instance profile) are the correct, secure answer.

Policies

A policy is a JSON document that lists permissions. IAM attaches policies to identities (users, groups, roles), and some services attach policies to resources. There are three ownership types for identity policies:

AWS managed policies are created and maintained by AWS, such as ReadOnlyAccess , AdministratorAccess , or AmazonS3ReadOnlyAccess . They are convenient starting points, and AWS updates them when new services or actions appear. Some are job function policies aligned to roles like billing, database administrator, or data scientist. Customer managed policies are policies you write and maintain in your account. They can be attached to many identities and are versioned, so you can roll back.

Inline policies are embedded directly in a single user, group, or role and are deleted with it. Use them sparingly, for strict one-to-one relationships.

6.4 Reading a policy

You will not be asked to write JSON on the Cloud Practitioner exam, but you should recognize the structure and be able to say what a simple policy allows. Here is a customer managed policy that lets a team read objects in one S3 bucket, but only when they signed in with MFA:

Version is the policy language version. 2012-10-17 is the current one; it is a fixed string, not today’s date. Statement is a list of one or more permission statements.

Sid (statement ID) is an optional label to help humans read the policy.

Effect is either Allow or Deny .

Action lists API operations, written as service:Operation . Wildcards are allowed: s3:Get* means every S3 action that starts with “Get”, and * alone means every action in every service.

Resource lists the resources the statement applies to, identified by Amazon Resource Names (ARNs). Notice that the bucket itself ( example-reports ) and the objects inside it ( example-reports/* ) are separate resources. Condition is optional and narrows when the statement applies. Here the allow only works if MFA was used. Other common conditions check the source IP address, the Region of the request, the time, or resource tags. A resource-based policy (covered next) also has a Principal element naming who the policy applies to, because it is attached to the resource rather than to a person.

Good to know

An ARN follows the pattern arn:partition:service:region:account-id:resource . For global services like IAM and for S3 bucket names, the Region and sometimes the account fields are left empty, which is why the S3 ARNs above contain ::: .

6.5 Identity-based versus resource-based policies

Identity-based policies are attached to an IAM user, group, or role. They answer, “What can this identity do?” Everything in the example above is identity-based.

Resource-based policies are attached to a resource and answer, “Who can access this resource?” They always include a Principal . Examples you should recognize:

Amazon S3 bucket policies, often used to grant another account access, or to require encryption or HTTPS. AWS KMS key policies, which control who can use and manage an encryption key (every KMS key must have one).

Amazon SQS queue policies and Amazon SNS topic policies.

AWS Lambda resource policies, which allow, for example, S3 or API Gateway to invoke a function.

IAM role trust policies, which are a special type of resource-based policy on the role itself.

Resource-based policies are especially handy for cross-account access: the bucket owner can name a principal in another account directly in the bucket policy.

Identity-based Resource-based
Attached to User, group, or role Bucket, key, queue, function, and so on
Has Principal ? No (the identity is implied) Yes

Typical question What can Maria do? Who can read this bucket?

Other policy types you may see mentioned

Permissions boundaries set the maximum permissions an identity-based policy can grant to a user or role. They are useful when you let developers create roles but want to cap what those roles can do.

Service control policies (SCPs) and resource control policies (RCPs) from AWS Organizations set maximum permissions across whole accounts (section 6.10).

Session policies limit a temporary session further when a role is assumed.

None of these “guardrail” types grant permissions on their own. They only filter what other policies allow.

6.6 How AWS evaluates a request

When a request arrives, AWS gathers every policy that applies (identity-based, resource-based, SCPs, permissions boundaries, session policies) and follows a consistent logic:

1. By default, everything is denied. This is the implicit deny.
2. If any applicable policy contains an explicit deny that matches the request, the request is denied. Full stop. Nothing can override an explicit deny.
3. Otherwise, if a policy contains an explicit allow that matches, and no guardrail (SCP, boundary, session policy) blocks it, the request is allowed.
4. If nothing allows it, the implicit deny stands.

How AWS evaluates a request (simplified)
Request arrives
Start: implicit deny
Any explicit

Deny matches?

Yes DENIED
explicit deny
No
Any explicit

Allow matches?

D No ENIED
implicit deny
Yes

Guardrails also allow?

SCP, RCP, boundary,
session policy
Yes

Allowed

Figure 6.3: Policy evaluation logic. An explicit deny always wins, then an explicit allow, and anything not allowed is implicitly denied.

Look back at the example policy: even if another policy attached to the same user said "Action": "s3:*" , the NeverDeleteReports statement would still block deletes, because explicit deny beats allow.

Exam tip

Remember the order as “deny, allow, deny”: explicit deny beats everything; an explicit allow is needed to do anything; and the default is an implicit deny.

6.7 The principle of least privilege

Least privilege means granting only the permissions required to perform a task, and nothing more. A reporting job that reads one bucket should not have s3:* on every bucket. A developer who deploys Lambda functions should not be able to delete VPCs.

Least privilege is a journey, not a one-time setting. A practical approach:

1. Start with AWS managed policies to get people productive, ideally job-function or read-only policies.
2. Observe actual usage. IAM’s last accessed information (sometimes called Access Advisor, shown on the user, group, role, or policy page) tells you which services an identity has used and when. IAM Access Analyzer can generate a policy from the actions an identity actually performed, as recorded in AWS CloudTrail.
3. Replace broad policies with customer managed policies scoped to the specific actions and resources needed.
4. Remove unused users, roles, keys, and permissions on a regular schedule.

Related ideas that appear on the exam: separation of duties (the person who approves a change is not the person who deploys it) and using temporary credentials whenever possible, so access expires on its own.

6.8 Credentials and how to protect them

Multi-factor authentication

MFA adds “something you have” to “something you know.” Even if a password leaks, an attacker cannot sign in without the second factor. You can register up to eight MFA devices for the root user and for each IAM user, which makes it easy to keep a backup. Supported types:

MFA type What it is Example
Passkeysand FIDO2 security keys Phishing-resistant, uses public key
cryptography
A USB or NFC key, ora passkey stored on
a phone or laptop
Virtual authenticatorapp Time-based one-time password (TOTP)
app on a phone
Google Authenticator, Microsoft
Authenticator, Authy

Hardware TOTP token Physical device that displaysasix-digit code A key fob or display card For the exam, know that MFA should be enabled for the root user and for every human user, and that FIDO2 security keys and passkeys are the most phishing-resistant choice. MFA can also be required in policies (as in the example policy’s Condition ) and for deleting versioned S3 objects (MFA delete).

Hands-on lab

Mini lab: create an IAM user with console access and MFA

1. Sign in to the console as an administrator (not the root user) and open IAM.
2. Choose Users, then Create user. Enter a user name such as maria.lopez .
3. Select Provide user access to the AWS Management Console. Choose a custom password or an autogenerated one, and keep Users must create a new password at next sign-in selected.
4. On the permissions step, choose Add user to group and pick an existing group such as Developers (or create one and attach an AWS managed policy like ReadOnlyAccess ).
5. Review and choose Create user. Share the sign-in URL and temporary password securely.
6. Open the new user, choose the Security credentials tab, and in Multi-factor authentication (MFA) choose Assign MFA device.
7. Pick a device type (passkey or security key, authenticator app, or hardware TOTP token), give it a name, and follow the prompts. For an authenticator app, scan the QR code and enter two consecutive codes.
8. Sign out and sign in as the new user with the account’s sign-in URL to confirm that MFA is requested.

Cloud console - IAM

Console Home Search services Global | admin-user

Iam

Figure 6.4: Creating an IAM user and assigning an MFA device in the IAM console. (Illustration, not an actual AWS screenshot.) Access keys

Access keys are long-term credentials for programmatic access: the AWS CLI, SDKs, and tools that call AWS APIs. Each key has two parts: an access key ID (like a user name, for example beginning with AKIA ) and a secret access key (like a password, shown only once when created). Each IAM user can have at most two access keys, which exists so you can rotate: create the new key, update your application, then deactivate and delete the old one.

Rules to live by:

Never create access keys for the root user.

Never put access keys in source code, in a public repository, or in an AMI.

Prefer roles (for workloads on AWS) and IAM Identity Center or aws sso login (for people using the CLI), both of which give temporary credentials.

If keys must exist, rotate them regularly and delete unused ones.

Common trap

Exam questions sometimes ask what to do if access keys were accidentally pushed to a public code repository. The right first step is to deactivate (and then delete) the exposed keys and create new ones, then review CloudTrail for activity. Simply making the repository private is not enough: automated scanners find exposed keys within minutes.

Password policy

An account password policy sets rules for IAM user passwords: minimum length, required character types (uppercase, lowercase, numbers, symbols), maximum password age (forcing rotation), prevention of password reuse, and whether users can change their own password. The password policy applies to IAM users only, not to the root user, and not to users signing in through IAM Identity Center with an external identity provider (that provider enforces its own rules).

Credential report and last accessed data

The IAM credential report is an account-wide CSV file that lists every IAM user and the status of their credentials: whether a password is enabled and when it was last used and changed, whether MFA is active, and the age and last use of each access key. Auditors love it, and it is the classic exam answer for “Which tool lists all users and the status of their passwords, access keys, and MFA devices?”

Do not confuse it with last accessed information (Access Advisor), which is per identity and shows services used, helping you trim permissions.

Tool Scope Answers

Credential report Wholeaccount, all users Who has old keys, unused passwords, or no

Mfa?

Lastaccessed (Access Advisor) One user, group, role, or policy Which services does this identity actually use?

6.9 IAM Access Analyzer

IAM Access Analyzer uses automated reasoning (mathematical logic, not guesswork) to analyze policies. It has several capabilities:

External access findings. It identifies resources, such as S3 buckets, KMS keys, IAM roles, Lambda functions, and SQS queues, that are shared with a principal outside your account or your organization (the “zone of trust” you define). If a bucket is accidentally shared publicly, Access Analyzer flags it.

Internal access findings. It can also highlight which identities inside your organization can reach critical resources. Unused access findings. It reports unused roles, unused access keys and passwords, and unused permissions, which supports least privilege.

Policy validation. As you write a policy, it checks grammar and best practices and warns about overly permissive statements.

Policy generation. It builds a least-privilege policy from the activity recorded in CloudTrail.

Exam tip

“Which service identifies resources shared with external entities?” points to IAM Access Analyzer. “Which service lists all users and their credential status?” points to the credential report.

6.10 Managing many accounts: AWS Organizations

Most companies outgrow a single AWS account. Separate accounts give strong isolation (a mistake in a development account cannot touch production), simpler billing by team or project, and clean security boundaries. AWS Organizations lets you create and manage those accounts centrally, at no additional charge.

Key concepts

Organization: the whole collection of accounts you manage together.

Management account: the account that creates the organization. It pays the bill for all accounts and administers the organization. (Older material calls it the “master account.”) Keep workloads out of it.

Member accounts: every other account in the organization. An account belongs to exactly one organization at a time.

Organizational units (OUs): folders that group accounts, for example Security , Infrastructure , Workloads/Prod , Workloads/Dev , and Sandbox . OUs can be nested, and policies attached to an OU apply to every account beneath it.

Root: the top-level container of the organization’s tree (not to be confused with the root user). AWS Organizations: OUs, SCPs, and consolidated billing

Figure 6.5: An AWS Organizations tree. SCPs attached to the root and to OUs filter what member accounts can do; consolidated billing rolls every account up to the management account.

Service control policies

A service control policy (SCP) sets the maximum available permissions for the accounts it applies to. SCPs look like IAM policies, but they do not grant anything. Even a user with AdministratorAccess in a member account cannot perform an action that an SCP denies. SCPs affect all IAM users and roles in member accounts, including the root user of those accounts.

Typical SCP uses:

Deny use of any Region outside the ones the company operates in (a data residency control).

Prevent anyone from disabling AWS CloudTrail or leaving the organization.

Block expensive instance types in the Sandbox OU.

Important limits: SCPs do not affect the management account, and they do not affect service-linked roles that AWS services use.

A newer, related type, the resource control policy (RCP), sets maximum permissions on resources (such as S3 buckets or KMS keys) across the organization, for example to ensure no bucket can ever be accessed by an identity outside the organization. Think of SCPs as limiting what your people can do, and RCPs as limiting what can be done to your resources.

Common trap

“An administrator in a member account has full IAM permissions but cannot launch instances in a certain Region. Why?” The answer is an SCP. Remember that SCPs filter permissions; they never add them.

Consolidated billing

Every organization has consolidated billing:

One bill for all accounts, paid by the management account, with a breakdown per account.

Combined usage for volume pricing tiers. Usage of services such as S3 or data transfer is aggregated, so you reach cheaper tiers sooner.

Sharing of Reserved Instance and Savings Plans discounts across accounts (this sharing can be turned off). No extra cost.

Consolidated billing is covered again in the billing chapter (Chapter 15), but it is often tested alongside Organizations.

Other Organizations features

Organizations also offers tag policies (enforce consistent tags), backup policies (central AWS Backup plans), AI services opt-out policies, and delegated administrator (let a security account run services such as GuardDuty or Security Hub for the whole organization). Many security services integrate with Organizations so you can enable them everywhere at once.

6.11 AWS Control Tower

Setting up a well-governed multi-account environment by hand involves many steps: creating the organization, a log archive account, a security audit account, centralized CloudTrail logging, SCPs, AWS Config rules, and IAM Identity Center. AWS Control Tower automates all of that.

It builds a landing zone: a well-architected, multi-account baseline based on AWS best practices. It applies controls (formerly called guardrails): preventive controls (implemented as SCPs or RCPs, they stop actions), detective controls (implemented with AWS Config rules, they detect noncompliance), and proactive controls (implemented with AWS CloudFormation hooks, they check resources before they are created). Account Factory lets teams request new accounts that are automatically provisioned with the approved baseline. A dashboard shows compliance across accounts.

The simplest way to remember it: Organizations is the engine; Control Tower is the guided, best-practice setup and ongoing governance built on top of it.

Real-world example

Real-world scenario: A retailer with 40 development teams wants each team to have its own account, with logging, security baselines, and Region restrictions applied automatically, and a single place to check compliance. AWS Control Tower with Account Factory is the best fit. If the question only asked for consolidated billing across a few existing accounts, AWS Organizations alone would be enough.

6.12 Workforce sign-in: IAM Identity Center

AWS IAM Identity Center (the successor to AWS Single Sign-On) is the recommended way for your workforce (employees and contractors) to access AWS accounts and business applications.

Users sign in once to an AWS access portal and see every account and role they are entitled to, plus integrated applications.

You choose an identity source: the built-in Identity Center directory, an Active Directory (through AWS Directory Service), or an external identity provider such as Microsoft Entra ID, Okta, or Google Workspace, connected with SAML 2.0 and often SCIM for automatic user provisioning.

Administrators define permission sets (collections of policies) and assign them to users or groups for specific accounts in the organization. Identity Center then creates the matching roles in each account automatically. Users get temporary credentials, both in the console and for the CLI.

IAM Identity Center works best with AWS Organizations, and it is the answer whenever a question mentions single sign-on across multiple AWS accounts or using existing corporate credentials to access AWS.

6.13 Customer sign-in: Amazon Cognito

IAM and Identity Center are for people who build and operate on AWS. Amazon Cognito is for the customers of your applications: people signing up for your mobile game or your e-commerce website, potentially millions of them. User pools are user directories that provide sign-up and sign-in, including password policies, MFA, account recovery, and sign-in with social identity providers (Google, Apple, Facebook, Amazon) or enterprise SAML and OpenID Connect providers. After sign-in, the app receives tokens.

Identity pools exchange those tokens (or even guest access) for temporary AWS credentials, so the app can, for example, upload a profile photo directly to S3 with tightly limited permissions.

Exam tip

Look for words like “mobile app,” “web app users,” “customer sign-up,” or “social login.” Those point to Amazon Cognito. “Employees,” “multiple AWS accounts,” and “single sign-on” point to IAM Identity Center.

6.14 AWS Directory Service

Many enterprises already run Microsoft Active Directory (AD). AWS Directory Service brings AD to AWS in three flavors:

AWS Managed Microsoft AD: a real Microsoft AD, managed by AWS and deployed across two Availability Zones. It can trust your on-premises AD. Use it when Windows workloads on AWS (such as SQL Server or Amazon FSx for Windows File Server) need AD.

AD Connector: a proxy that redirects authentication requests to your existing on-premises AD without storing any directory data in the cloud.

Simple AD: a low-cost, Samba-based, AD-compatible directory for basic needs.

Directory Service can also act as an identity source for IAM Identity Center.

6.15 Sharing resources: AWS Resource Access Manager

Sometimes accounts need to use the same resource. Rather than duplicating it, AWS Resource Access Manager (AWS RAM) lets you share specific resources with other accounts in your organization (or with specific external accounts, for supported resource types). Commonly shared resources include:

VPC subnets (so several accounts launch instances into a central, network-team-owned VPC)

AWS Transit Gateway attachments
Route 53 Resolver rules
AWS License Manager configurations

Some database and capacity resources, such as Aurora DB clusters and Capacity Reservations The owner keeps control of the resource; participants can use it according to the share. RAM has no additional charge.

6.16 Choosing the right identity service

Need Service
Permissions inside oneaccount IAM (users, groups, roles, policies)
Workforce SSO across many accounts IAM Identity Center
App sign-up and sign-in for customers Amazon Cognito
Microsoft Active Directory on AWS AWS Directory Service
Central account managementand billing AWS Organizations
Automated, governed multi-account setup AWS Control Tower
Sharearesource with otheraccounts AWS RAM
Find externally shared or unused access IAM Access Analyzer

6.17 IAM best practices checklist

Use this list for exam review and for your own accounts:

1. Protect the root user: enable MFA, delete root access keys, and use root only for root-only tasks.
2. Use federation and IAM Identity Center so people use temporary credentials.
3. Use IAM roles for workloads such as EC2 instances and Lambda functions. Never embed access keys.
4. Require MFA for all human users; prefer phishing-resistant keys or passkeys.
5. Apply least privilege: start broad only when necessary, then refine with last accessed data and Access Analyzer.
6. Assign permissions to groups (or permission sets), not to individual users.
7. Set a strong password policy for any IAM users.
8. Rotate access keys that must exist, and remove unused users, roles, keys, and passwords.
9. Use conditions in policies for extra protection (MFA required, source IP, approved Regions).
10. Use permissions guardrails across accounts: SCPs, RCPs, and permissions boundaries.
11. Audit regularly with the credential report, IAM Access Analyzer, and AWS CloudTrail.
12. Use multiple accounts organized with AWS Organizations (and Control Tower) to isolate workloads.

Chapter 6 summary

The root user has unrestricted access; protect it with MFA, delete its access keys, and use it only for root-only tasks such as closing the account, changing the support plan, or changing the account email.

IAM users have long-term credentials, groups collect users to share permissions (no nesting), and roles provide temporary credentials through AWS STS to services, other accounts, and federated users.

Policies are JSON documents with Effect, Action, Resource, and optional Condition; resource-based policies also name a Principal.

AWS evaluates requests as explicit deny > explicit allow > implicit deny; new identities start with no permissions. Least privilege is achieved iteratively using managed policies, last accessed data, and IAM Access Analyzer policy generation.

Protect credentials with MFA (passkeys and security keys, authenticator apps, hardware tokens), avoid long-term access keys, set a password policy, and audit with the credential report.

AWS Organizations groups accounts into OUs, applies SCPs that limit (never grant) permissions, and provides free consolidated billing.

AWS Control Tower automates a governed landing zone with preventive, detective, and proactive controls. Use IAM Identity Center for workforce SSO, Amazon Cognito for application users, AWS Directory Service for Active Directory, and AWS RAM to share resources across accounts.

Key terms
Term Definition
Root user Theaccount’s original identity with full, unrestricted access
IAM user An identity with long-term credentials for one person or
workload
IAM group A set of IAM users that shareattached policies
IAM role An identity assumed for temporary credentials; hasatrust policy
and a permissions policy
AWS STS Service that issues temporary security credentials
Instance profile Container that passesan IAM role to an EC2 instance
Policy JSON document thatallows or deniesactions on resources
Explicit deny A Deny statement that overridesany Allow
Implicit deny The default result when nothing allowsarequest
Least privilege Granting only the permissions required foratask
Credential report Account-wide CSV of usersand their credential status
IAM Access Analyzer Finds external, internal, and unused access; validatesand
generates policies
SCP Organizations policy that sets maximum permissions foraccounts
Permission set IAM Identity Center template of permissionsassigned to users
peraccount
Landing zone Control Tower’s governed multi-account baseline
Practice questions

1. A company has just created a new AWS account. Which action should the company take first to secure the root user?

A. Create access keys for the root user and store them in a

password vault

B. Enable multi-factor authentication on the root user
C. Attach the AdministratorAccess policy to the root user D. Add the root user to an IAM group with read-only permissions

2. Which task can be performed only by signing in as the root user?

A. Creating an IAM role for an EC2 instance B. Launching an EC2 instance in a new Region
C. Changing the account’s AWS Support plan D. Viewing the IAM credential report

3. An application running on Amazon EC2 needs to write files to an S3 bucket. What is the MOST secure way to give it access?

A. Store an IAM user’s access keys in a configuration file on

the instance

B. Attach an IAM role to the instance through an instance

profile

C. Embed the root user’s access keys in the application code D. Make the bucket public so no credentials are required

4. A newly created IAM user signs in to the console but cannot view any resources. What is the most likely reason?

A. The user has not enabled MFA B. New IAM users have no permissions until a policy is attached
C. IAM users can only use the AWS CLI D. The account’s password policy blocks console access

5. A policy attached to a group allows s3:* on all buckets. A policy attached directly to one user in that group denies s3:DeleteObject . What happens when that user tries to delete an object?

A. The delete succeeds because the group policy allows all

S3 actions

B. The delete succeeds because group policies take priority
C. The delete is denied because an explicit deny overrides

any allow

D. The result depends on which policy was created first

6. Which element appears in a resource-based policy but NOT in an identity-based policy?

A. Effect B. Action
C. Principal D. Condition

7. A security auditor needs a single report showing every IAM user in an account, whether each has MFA enabled, and when each user’s access keys were last rotated and used. Which feature provides this?

A. IAM credential report B. AWS Trusted Advisor
C. IAM last accessed information D. Amazon Inspector

8. A company wants to find any S3 buckets, KMS keys, or IAM roles in its organization that are accessible from outside the organization. Which service should it use?

A. AWS Config B. IAM Access Analyzer
C. Amazon Macie D. AWS Artifact

9. A company has 15 AWS accounts and wants employees to sign in once with their existing Microsoft Entra ID credentials and access the accounts they are assigned to. Which service meets this need?

A. Amazon Cognito user pools B. AWS Directory Service Simple AD
C. IAM Identity Center D. IAM users in each account with the same password

10. A startup is building a mobile app and wants its customers to sign up, sign in with Google or Apple, and upload photos to S3. Which service should it use for user authentication?

A. IAM Identity Center B. Amazon Cognito
C. AWS Directory Service D. IAM groups

11. An administrator in a member account has the AdministratorAccess policy but receives an access denied error when launching resources in the ap-southeast-2 Region. What is the most likely cause?

A. The account’s password policy restricts Regions B. A service control policy denies actions in that Region
C. IAM is not available in that Region D. The administrator’s MFA device has expired

12. Which statements about service control policies (SCPs) are correct? (Choose two.)

A. SCPs grant permissions to IAM users in member

accounts

B. SCPs set the maximum permissions available to accounts

they apply to

C. SCPs restrict the management account’s users D. SCPs can restrict the root user of a member account
E. SCPs replace the need for IAM policies

13. Which benefits does consolidated billing in AWS Organizations provide? (Choose two.)

A. Combined usage across accounts for volume pricing

discounts

B. A free upgrade to the Business Support plan
C. A single bill for all member accounts D. Automatic deletion of unused resources
E. Free data transfer between all Regions

14. A company wants to set up a new multi-account environment that follows AWS best practices, with centralized logging, preventive and detective controls, and a self-service way to create new accounts. Which service is designed for this?

A. AWS Control Tower B. AWS Resource Access Manager
C. AWS Systems Manager D. Amazon Cognito

15. A network team owns a VPC in a central account and wants application teams in other accounts in the organization to launch EC2 instances into its subnets. Which service enables this?

A. AWS Direct Connect B. AWS Resource Access Manager
C. Amazon Route 53 D. IAM Access Analyzer

16. A developer accidentally committed IAM access keys to a public code repository. What should be done FIRST?

A. Make the repository private B. Deactivate the exposed access keys and create new ones
C. Enable MFA for the developer D. Delete the developer’s IAM user and all of their resources

17. Which MFA option offers the strongest protection against phishing?

A. A password policy requiring 20 characters B. A virtual authenticator app showing six-digit codes
C. A FIDO2 security key or passkey D. An SMS text message to a personal phone

18. A company runs Windows workloads on EC2 that require Microsoft Active Directory. It wants AWS to manage the domain controllers, deployed across multiple Availability Zones. Which option fits?

A. AD Connector B. AWS Managed Microsoft AD
C. Amazon Cognito identity pools D. IAM groups

19. Which statement about IAM groups is correct?

A. Groups can contain other groups B. A user can belong to only one group
C. Groups can be specified as a principal in an S3 bucket

policy

D. Policies attached to a group apply to all users in the

group

20. A company wants to grant a group of developers only the permissions they actually use. Which approach best supports the principle of least privilege? (Choose two.)

A. Attach AdministratorAccess so developers are never

blocked

B. Use IAM Access Analyzer to generate a policy based on

CloudTrail activity

C. Review IAM last accessed information and remove

unused service permissions

D. Share one IAM user’s credentials among the developers
E. Use the root user for deployments so permissions are

never an issue

Answers and explanations

1. B. Enabling MFA is the first step to protect the root user. Creating root access keys (A) is discouraged, and IAM policies cannot be attached to the root user or used to group it (C, D).
2. C. Changing or canceling the support plan is a root-only task. Roles, instance launches, and credential reports (A, B,

D) can all be handled by IAM identities with the right permissions.

3. B. An IAM role delivered through an instance profile gives the instance temporary, automatically rotated credentials. Stored or embedded keys (A, C) can leak, and a public bucket (D) exposes data to everyone.
4. B. IAM identities start with an implicit deny and need policies to do anything. MFA (A) and password policies (D) affect sign-in, not permissions after sign-in.
5. C. An explicit deny anywhere always overrides an allow. Policy source and creation order (B, D) do not change evaluation.
6. C. Resource-based policies must name a Principal because they are attached to a resource. Effect, Action, and Condition (A, B, D) appear in both types.
7. A. The credential report lists all users with password, access key, and MFA status. Last accessed information (C) shows services used per identity, Trusted Advisor (B) gives broad checks, and Inspector (D) scans for software vulnerabilities.
8. B. IAM Access Analyzer identifies resources shared outside the zone of trust. Macie (C) finds sensitive data in S3, Config (A) records configuration, and Artifact (D) provides compliance reports.
9. C. IAM Identity Center provides workforce single sign-on across accounts in an organization and can use Entra ID as its identity source. Cognito (A) is for application customers, and duplicated IAM users (D) are insecure and hard to manage.
10. B. Amazon Cognito handles customer sign-up and sign-in, social identity providers, and temporary AWS credentials through identity pools. Identity Center (A) is for the workforce.
11. B. SCPs can deny actions in Regions even for administrators, because they set maximum permissions. Password policies (A) do not restrict Regions, and IAM is a global service (C).
12. B, D. SCPs set maximum permissions and do apply to member account root users. They never grant permissions (A), do not affect the management account (C), and do not replace IAM policies (E).
13. A, C. Consolidated billing combines usage for volume tiers and produces one bill. It does not change support plans, delete resources, or make data transfer free (B, D, E).
14. A. AWS Control Tower builds a best-practice landing zone with controls and Account Factory. RAM (B) shares resources, and Systems Manager (C) manages instances.
15. B. AWS RAM shares VPC subnets with other accounts in the organization. Direct Connect (A) is a network link to on premises, and Access Analyzer (D) analyzes access.
16. B. Deactivate the exposed keys immediately and replace them, then investigate with CloudTrail. Making the repository private (A) does not invalidate keys that may already be copied.
17. C. FIDO2 security keys and passkeys use public key cryptography bound to the site, which resists phishing. Authenticator codes (B) can be typed into a fake site, and SMS (D) is not an IAM MFA option.
18. B. AWS Managed Microsoft AD runs a real AD, managed by AWS, across two Availability Zones. AD Connector (A) only proxies to an existing on-premises directory.
19. D. Group policies apply to all members. Groups cannot be nested (A), users can be in multiple groups (B), and groups cannot be principals (C).
20. B, C. Access Analyzer policy generation and last accessed information help narrow permissions to what is used. AdministratorAccess, shared credentials, and root use (A, D, E) violate least privilege.