AWS Certified Solutions Architect – Associate Identity, Access Management & Security Syllabus

Identity, Access Management & Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Identity, Access Management & Security in AWS Certified Solutions Architect – Associate, not a summary of it.

1. 1

   AWS Identity and Access Management (IAM)

   4 topics

   • Users, groups and roles
     • IAM roles for cross-account and service access
     • Instance profiles for EC2
   • IAM policies
     • Identity-based vs resource-based policies
     • Policy evaluation logic (explicit deny, allow, implicit deny)
     • Permission boundaries and SCPs
   • Multi-Factor Authentication and credential rotation
   • IAM Access Analyzer and least-privilege design
2. 2

   Federation & Directory Services

   3 topics

   • Identity federation patterns
     • SAML 2.0 and web identity federation
     • IAM Identity Center (AWS SSO)
   • AWS Directory Service
     • Managed Microsoft AD, AD Connector and Simple AD
   • Amazon Cognito user pools and identity pools
3. 3

   Data Protection & Encryption

   4 topics

   • AWS Key Management Service (KMS)
     • Customer managed vs AWS managed keys
     • Envelope encryption and key policies
   • Encryption in transit and at rest
     • TLS/SSL and ACM certificates
     • SSE-S3, SSE-KMS, SSE-C and client-side encryption
   • AWS Secrets Manager vs Systems Manager Parameter Store
   • CloudHSM for dedicated hardware key storage
4. 4

   Threat Detection & Compliance

   4 topics

   • Detective and monitoring services
     • Amazon GuardDuty
     • Amazon Inspector and Amazon Macie
   • AWS WAF, AWS Shield and Shield Advanced
   • Auditing and governance
     • AWS Config rules and conformance packs
     • AWS CloudTrail event history and trails
     • AWS Artifact for compliance reports
   • AWS Security Hub centralized findings

Identity, Access Management & Security flashcards for AWS Certified Solutions Architect – Associate

25 of 51 cards from the Identity, Access Management & Security deck — real questions with worked answers.

1. What is the difference between an IAM user, an IAM group, and an IAM role?

   An IAM user is a permanent identity with long-term credentials for a person or application. An IAM group is a collection of users used to assign permissions in bulk (it cannot be a principal and has no credentials). An IAM role is an identity with temporary credentials that can be assumed by users, services, or external identities and has no long-term credentials of its own.

2. Why are IAM roles preferred over IAM users for granting AWS access to EC2 instances and applications?

   Roles provide temporary, automatically rotated credentials via the instance metadata service (STS), so there are no long-term access keys to store, leak, or manually rotate.

3. What are the two policy documents that define an IAM role, and what does each do?

   The trust policy (assume-role policy) defines WHO is allowed to assume the role (the principal). The permissions policy defines WHAT actions and resources the role can access once assumed.

4. What are the main types of IAM policies in AWS?

   Identity-based policies (attached to users, groups, roles), resource-based policies (attached to resources like S3 buckets and specifying a principal), permissions boundaries, Service Control Policies (SCPs in AWS Organizations), session policies, and ACLs.

5. What are the required and key elements of an IAM policy statement?

   Effect (Allow/Deny, required), Action (required), and Resource (required for identity-based policies). Optional elements include Principal, Condition, and Sid.

6. In IAM policy evaluation logic, how are Allow and Deny resolved?

   By default everything is implicitly denied. An explicit Allow grants access, but an explicit Deny always overrides any Allow. So the order is: explicit Deny > explicit Allow > implicit Deny.

7. What is the difference between an AWS managed policy, a customer managed policy, and an inline policy?

   AWS managed policies are created and maintained by AWS for common use cases. Customer managed policies are created and maintained by you and are reusable across identities. Inline policies are embedded directly into a single user, group, or role with a strict one-to-one relationship.

8. What is an IAM permissions boundary?

   A permissions boundary is an advanced feature that uses a managed policy to set the MAXIMUM permissions an identity-based policy can grant to a user or role. Effective permissions are the intersection of the permissions boundary and the identity policy.

9. What is a Service Control Policy (SCP) in AWS Organizations?

   An SCP is a guardrail applied to AWS accounts/OUs in an Organization that sets the maximum available permissions for all principals in those accounts. SCPs do not grant permissions; they only set the boundary, and they do not affect the management account.

10. What is Multi-Factor Authentication (MFA) in AWS and why is it used?

    MFA requires a second authentication factor (a code from a virtual/hardware device, FIDO security key, or SMS) in addition to a password. It adds a layer of protection so that a compromised password alone cannot grant access.

11. What MFA device types does AWS support?

    Virtual MFA apps (e.g., Google Authenticator, Authy), FIDO security keys (e.g., YubiKey), and hardware TOTP tokens. (SMS text-message MFA is being deprecated.)

12. What is a best practice for the AWS account root user regarding MFA and daily use?

    Enable MFA on the root user, lock away its credentials, and do not use it for everyday tasks. Use IAM users/roles with least privilege for daily operations instead.

13. What is credential rotation and which IAM credentials should be rotated?

    Credential rotation is regularly changing long-term credentials to limit exposure. Access keys and passwords should be rotated periodically; roles with temporary STS credentials rotate automatically.

14. How can you require IAM users to rotate their passwords?

    By configuring an account password policy that sets a maximum password age (expiration), minimum length, complexity requirements, and prevents password reuse.

15. What is AWS IAM Access Analyzer and what does it detect?

    IAM Access Analyzer uses automated reasoning to identify resources (S3 buckets, IAM roles, KMS keys, etc.) shared with external entities, helping you find unintended public or cross-account access. It can also generate least-privilege policies based on CloudTrail activity and validate policies.

16. What is the principle of least privilege?

    Granting an identity only the minimum permissions required to perform its tasks, and nothing more, to reduce the attack surface and blast radius of compromised credentials.

17. How does IAM Access Analyzer help achieve least-privilege design?

    It can generate fine-grained IAM policies based on the actual access activity recorded in CloudTrail, validate policies against best practices and grammar, and identify unused access, so you can right-size permissions.

18. What is identity federation in AWS?

    Identity federation lets users authenticate with an external identity provider (corporate directory, social login, or another IdP) and then assume an IAM role to access AWS without creating IAM users for each person.

19. What are the two main standards/types of identity federation supported by AWS IAM?

    SAML 2.0 federation (for enterprise IdPs like Active Directory Federation Services) and OpenID Connect (OIDC) / web identity federation (for OAuth/OIDC providers and social logins, often via Cognito).

20. What AWS service provides single sign-on across multiple AWS accounts and business applications?

    AWS IAM Identity Center (formerly AWS SSO), which centralizes access management and SSO across an AWS Organization and connects to external identity providers.

21. What is AWS Directory Service and what is the fully managed Microsoft AD option?

    AWS Directory Service provides managed directories for AWS. AWS Managed Microsoft AD is a fully managed actual Microsoft Active Directory in the cloud, supporting trust relationships with on-premises AD and AD-aware workloads.

22. What are the three main flavors of AWS Directory Service?

    AWS Managed Microsoft AD (full Microsoft AD), AD Connector (a proxy that redirects requests to your existing on-premises AD without storing data), and Simple AD (a small, low-cost Samba-based directory for basic needs).

23. What is Amazon Cognito used for?

    Amazon Cognito provides authentication, authorization, and user management for web and mobile apps. It handles user sign-up/sign-in and access to AWS resources for application users.

24. What is the difference between a Cognito user pool and a Cognito identity pool?

    A user pool is a user directory that handles authentication (sign-up, sign-in) and returns JWT tokens. An identity pool (federated identities) provides authorization by exchanging tokens for temporary AWS credentials (via STS) to access AWS services.

25. In Cognito, what does a user pool return after a successful sign-in?

    JSON Web Tokens (JWTs): an ID token, an access token, and a refresh token.

See more Identity, Access Management & Security flashcards →

Planning Identity, Access Management & Security for AWS Certified Solutions Architect – Associate

Identity, Access Management & Security (AWS Certified Solutions Architect – Associate) FAQ