Chapter 4 of 6 · AWS SCS-C03
Identity and Access Management
Workforce and customer sign in, roles and STS, policy evaluation, conditions and ABAC, and access troubleshooting.
- 6topics
- 33 minfast track
- 2diagrams and exhibits
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Workforce Identity and FederationChoose between IAM Identity Center, SAML and OIDC federation, directory services and IAM users to give people and workloads…5 min
- 2Cognito and Application AuthenticationUnderstand Cognito user pools and identity pools, token types, MFA and federation, and how apps authenticate customers and get…Diagram6 min
- 3IAM Roles, STS and MFAUse IAM roles, trust policies, STS AssumeRole, external IDs, MFA conditions, session limits and IAM Roles Anywhere for temporary…5 min
- 4Policy Types and Evaluation LogicLearn how AWS evaluates identity, resource, SCP, RCP, boundary and session policies, with same account and cross account rules…Diagram6 min
- 5Conditions, ABAC and DelegationWrite precise IAM policies with condition keys, set operators, tag based access control, permission boundaries for delegation and…5 min
- 6Access Analysis and TroubleshootingFind and fix IAM problems with Access Analyzer findings, the policy simulator, credential reports, decoded denial messages and…6 min
About this chapter
What this chapter covers
Identity and access management decides who can do what in AWS. Almost every other control depends on it.
The chapter has two parts that follow the exam outline.
The first is authentication, which means proving who the caller is, whether that is an employee, a customer, a service or a workload outside AWS. The second is authorization, which means deciding what an authenticated caller may do, and finding out why a request was denied.
The chapter follows the Identity and Access Management domain of the AWS Certified Security Specialty SCS-C03 exam. Six pages cover its two outline topics.
How the topics fit together
Authentication produces a principal with temporary credentials, and authorization evaluates every policy that applies to that principal.
- Identity Center and federation give people short lived access to accounts.
- Cognito authenticates the customers of an application.
- Roles and STS provide temporary credentials, with MFA and external IDs for protection.
- Policy evaluation explains how identity, resource, SCP, boundary and session policies combine.
- Conditions, ABAC and boundaries make permissions precise and delegable.
- Access Analyzer and error decoding find excess access and explain denials.
When two answers both grant access, choose the one that uses temporary credentials, the narrowest scope and an explicit condition.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Policy JSON appears often in this domain. Read each example slowly, find the Effect, the Principal, the Action, the Resource and the Condition, and say out loud what it allows or denies.
Ready for more practice?
The full AWS SCS-C03 question bank has 858 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.