[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"next-aws-certified-cloud-practitioner-security-and-compliance-compliance-and-governance-monitoring-and-auditing-en":4,"lesson-aws-certified-cloud-practitioner-security-and-compliance-compliance-and-governance-monitoring-and-auditing-en":564,"prev-aws-certified-cloud-practitioner-security-and-compliance-compliance-and-governance-monitoring-and-auditing-en":575},null,{"locked":5,"reason":3,"meta":6,"item":18},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"IAM Fundamentals","Learn what AWS Identity and Access Management is, the four building blocks it gives you (users, groups, roles, and policies), and how AWS decides whether a request is allowed.",true,16,"beginner",[13,14,15,16,17],"Define what AWS IAM is and the access it controls","Identify the four core IAM building blocks: users, groups, roles, and policies","Explain the difference between an IAM user and an IAM role","Describe how IAM evaluates a request through authentication and authorization","Distinguish identity-based policies from resource-based policies",{"id":19,"title":7,"body":20,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":498,"infographics":499,"isFree":9,"learningObjectives":510,"meta":511,"navigation":9,"path":512,"quiz":513,"seo":561,"stem":562,"__hash__":563},"courses/courses/aws-certified-cloud-practitioner/en/domains/02-security-and-compliance/03-identity-and-access-management/01-iam-fundamentals.md",{"type":21,"value":22,"toc":485},"minimark",[23,28,32,35,39,42,59,70,74,77,82,85,89,92,96,103,106,110,121,124,276,302,305,309,312,317,332,338,342,345,398,401,405,481],[24,25,27],"h2",{"id":26},"who-can-do-what","Who can do what",[29,30,31],"p",{},"Every action in AWS comes down to one question: is this identity allowed to do this thing to this resource? AWS Identity and Access Management, or IAM, is the service that answers it. IAM is where you decide who can sign in to your account and what each person or application is permitted to do once they are in.",[29,33,34],{},"This matters because an AWS account starts with a single all-powerful login and nothing else. Real work involves many people and many applications, each needing a different slice of access. IAM is how you hand out those slices safely. It carries a large share of the Security and Compliance domain on the exam, so the building blocks here are worth learning well.",[24,36,38],{"id":37},"what-iam-is","What IAM is",[29,40,41],{},"IAM is a web service that controls access to your AWS resources. It does two jobs:",[43,44,45,53],"ul",{},[46,47,48,52],"li",{},[49,50,51],"strong",{},"Authentication"," confirms who is making a request. When you sign in with a password or an application calls AWS with a key, IAM checks those credentials against an identity it trusts.",[46,54,55,58],{},[49,56,57],{},"Authorization"," decides what that identity may do. Once AWS knows who you are, it checks your permissions to see whether the specific action you asked for is allowed.",[29,60,61,62,65,66,69],{},"Two facts about IAM are easy marks on the exam. First, IAM is a ",[49,63,64],{},"global service",": the identities you create are not tied to a Region, so you never choose a Region when creating a user or role. Second, IAM itself is ",[49,67,68],{},"free",". You pay only for the AWS resources your identities use, not for IAM.",[24,71,73],{"id":72},"the-building-blocks","The building blocks",[29,75,76],{},"IAM gives you four things to work with. Get these straight and most of the topic falls into place.",[78,79,81],"h3",{"id":80},"iam-users","IAM users",[29,83,84],{},"An IAM user is an identity for one person or one application that needs long-term access to your account. A user can have a password for console sign-in, access keys for programmatic access, or both. Each user is a distinct identity with its own credentials, which is what lets you tell who did what.",[78,86,88],{"id":87},"iam-groups","IAM groups",[29,90,91],{},"A group is a collection of users. You attach policies to the group, and every user in it inherits those permissions. Groups make permissions easier to manage: put your developers in a Developers group, attach the right policies once, and new developers get the same access the moment you add them. A group is not an identity you can sign in as, it has no credentials, and you cannot nest one group inside another.",[78,93,95],{"id":94},"iam-roles","IAM roles",[29,97,98,99,102],{},"A role is an identity you create with a set of permissions, but unlike a user it is not tied to one person and has no long-term password or access keys. Instead, a trusted principal ",[49,100,101],{},"assumes"," the role and receives temporary security credentials for that session. Roles are how you grant access without handing out permanent keys. Common uses include giving an EC2 instance permission to read from S3, letting one AWS account access another, and granting access to users who already have identities outside AWS.",[29,104,105],{},"The difference between a user and a role is a frequent exam point. A user is a permanent identity with its own credentials. A role is a temporary hat that a principal puts on, gets short-lived credentials, and takes off again.",[78,107,109],{"id":108},"iam-policies","IAM policies",[29,111,112,113,116,117,120],{},"A policy is a document, usually written in JSON, that lists permissions. You attach policies to users, groups, or roles to define what they can do. AWS also provides ",[49,114,115],{},"AWS managed policies",", ready-made policies for common jobs that you can attach as a starting point, alongside ",[49,118,119],{},"customer managed policies"," that you write yourself.",[29,122,123],{},"A simple policy statement has a few key parts:",[125,126,131],"pre",{"className":127,"code":128,"language":129,"meta":130,"style":130},"language-json shiki shiki-themes material-theme-lighter github-light github-dark","{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"s3:ListBucket\",\n      \"Resource\": \"arn:aws:s3:::my-example-bucket\"\n    }\n  ]\n}\n","json","",[132,133,134,143,173,188,194,217,238,258,264,270],"code",{"__ignoreMap":130},[135,136,139],"span",{"class":137,"line":138},"line",1,[135,140,142],{"class":141},"sP7_E","{\n",[135,144,146,150,154,157,160,164,168,170],{"class":137,"line":145},2,[135,147,149],{"class":148},"s39Yj","  \"",[135,151,153],{"class":152},"sseR_","Version",[135,155,156],{"class":148},"\"",[135,158,159],{"class":141},":",[135,161,163],{"class":162},"sjJ54"," \"",[135,165,167],{"class":166},"s_sjI","2012-10-17",[135,169,156],{"class":162},[135,171,172],{"class":141},",\n",[135,174,176,178,181,183,185],{"class":137,"line":175},3,[135,177,149],{"class":148},[135,179,180],{"class":152},"Statement",[135,182,156],{"class":148},[135,184,159],{"class":141},[135,186,187],{"class":141}," [\n",[135,189,191],{"class":137,"line":190},4,[135,192,193],{"class":141},"    {\n",[135,195,197,200,204,206,208,210,213,215],{"class":137,"line":196},5,[135,198,199],{"class":148},"      \"",[135,201,203],{"class":202},"sZMiF","Effect",[135,205,156],{"class":148},[135,207,159],{"class":141},[135,209,163],{"class":162},[135,211,212],{"class":166},"Allow",[135,214,156],{"class":162},[135,216,172],{"class":141},[135,218,220,222,225,227,229,231,234,236],{"class":137,"line":219},6,[135,221,199],{"class":148},[135,223,224],{"class":202},"Action",[135,226,156],{"class":148},[135,228,159],{"class":141},[135,230,163],{"class":162},[135,232,233],{"class":166},"s3:ListBucket",[135,235,156],{"class":162},[135,237,172],{"class":141},[135,239,241,243,246,248,250,252,255],{"class":137,"line":240},7,[135,242,199],{"class":148},[135,244,245],{"class":202},"Resource",[135,247,156],{"class":148},[135,249,159],{"class":141},[135,251,163],{"class":162},[135,253,254],{"class":166},"arn:aws:s3:::my-example-bucket",[135,256,257],{"class":162},"\"\n",[135,259,261],{"class":137,"line":260},8,[135,262,263],{"class":141},"    }\n",[135,265,267],{"class":137,"line":266},9,[135,268,269],{"class":141},"  ]\n",[135,271,273],{"class":137,"line":272},10,[135,274,275],{"class":141},"}\n",[43,277,278,290,297],{},[46,279,280,282,283,285,286,289],{},[49,281,203],{}," is ",[132,284,212],{}," or ",[132,287,288],{},"Deny",".",[46,291,292,294,295,289],{},[49,293,224],{}," lists the operations, like ",[132,296,233],{},[46,298,299,301],{},[49,300,245],{}," names what the actions apply to.",[29,303,304],{},"You do not need to write JSON by hand for the exam, but you should recognize these parts and know that Effect is what makes a statement permit or block an action.",[24,306,308],{"id":307},"how-a-request-is-evaluated","How a request is evaluated",[29,310,311],{},"When a principal makes a request, AWS works through it in order.",[313,314],"infographic",{"alt":315,"slug":316},"A request flow diagram showing a principal first authenticating to prove identity, then being authorized against attached policies, before the action is allowed to run on the target resource.","iam-authn-vs-authz",[318,319,320,326],"ol",{},[46,321,322,325],{},[49,323,324],{},"Authentication."," AWS matches the credentials in the request to a principal it trusts: an IAM user, a role session, or a federated identity.",[46,327,328,331],{},[49,329,330],{},"Authorization."," AWS gathers every policy that applies and checks whether the action is allowed.",[29,333,334,335,337],{},"The default answer is no. Access is denied unless a policy explicitly allows it, and an explicit ",[49,336,288],{}," in any policy always wins, even over an Allow. So a request succeeds only when something allows it and nothing denies it.",[24,339,341],{"id":340},"identity-based-and-resource-based-policies","Identity-based and resource-based policies",[29,343,344],{},"Policies come in two broad shapes, and telling them apart helps on the exam.",[346,347,348,366],"table",{},[349,350,351],"thead",{},[352,353,354,357,360,363],"tr",{},[355,356],"th",{},[355,358,359],{},"Attached to",[355,361,362],{},"Names a principal?",[355,364,365],{},"Example",[367,368,369,384],"tbody",{},[352,370,371,375,378,381],{},[372,373,374],"td",{},"Identity-based policy",[372,376,377],{},"A user, group, or role",[372,379,380],{},"No, the identity is the principal",[372,382,383],{},"A policy on a Developers group allowing S3 reads",[352,385,386,389,392,395],{},[372,387,388],{},"Resource-based policy",[372,390,391],{},"A resource",[372,393,394],{},"Yes, it names who is granted access",[372,396,397],{},"An S3 bucket policy granting another account access",[29,399,400],{},"Identity-based policies say \"this identity can do these things.\" Resource-based policies say \"these principals can do these things to me.\" A role is a special case: it carries both a permissions policy and a trust policy that names who is allowed to assume it.",[24,402,404],{"id":403},"exam-tips","Exam tips",[43,406,407,418,428,447,458,461,471],{},[46,408,409,410,413,414,417],{},"IAM controls ",[49,411,412],{},"authentication"," (who you are) and ",[49,415,416],{},"authorization"," (what you can do).",[46,419,420,421,424,425,427],{},"IAM is a ",[49,422,423],{},"global"," service and is ",[49,426,68],{},". You pay only for the resources identities use.",[46,429,430,431,434,435,438,439,442,443,446],{},"Four building blocks: ",[49,432,433],{},"users"," (a person or app), ",[49,436,437],{},"groups"," (a collection of users), ",[49,440,441],{},"roles"," (assumable, temporary credentials), and ",[49,444,445],{},"policies"," (JSON permissions).",[46,448,449,450,453,454,457],{},"A ",[49,451,452],{},"user"," has long-term credentials; a ",[49,455,456],{},"role"," is assumed for temporary credentials. Know this difference.",[46,459,460],{},"Groups have no credentials and cannot be nested.",[46,462,463,464,467,468,470],{},"Access is ",[49,465,466],{},"denied by default","; an explicit ",[49,469,288],{}," always overrides an Allow.",[46,472,473,476,477,480],{},[49,474,475],{},"Identity-based"," policies attach to users, groups, and roles. ",[49,478,479],{},"Resource-based"," policies attach to a resource and name the principal.",[482,483,484],"style",{},"html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s39Yj, html code.shiki .s39Yj{--shiki-light:#39ADB5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sseR_, html code.shiki .sseR_{--shiki-light:#9C3EDA;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sZMiF, html code.shiki .sZMiF{--shiki-light:#E2931D;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":130,"searchDepth":175,"depth":175,"links":486},[487,488,489,495,496,497],{"id":26,"depth":145,"text":27},{"id":37,"depth":145,"text":38},{"id":72,"depth":145,"text":73,"children":490},[491,492,493,494],{"id":80,"depth":175,"text":81},{"id":87,"depth":175,"text":88},{"id":94,"depth":175,"text":95},{"id":108,"depth":175,"text":109},{"id":307,"depth":145,"text":308},{"id":340,"depth":145,"text":341},{"id":403,"depth":145,"text":404},"md",[500],{"slug":316,"concept":501,"style":502,"aspectRatio":503,"labels":504},"A directed two-gate request flow that shows how AWS handles every request: a principal (an IAM user, role session, or federated identity) first passes an authentication gate that matches its credentials to a trusted identity, then an authorization gate where AWS gathers every applying policy and checks the action, and only then reaches the resource. The authorization gate carries the orange accent because that is where the decision happens: access is denied by default and an explicit Deny always wins over an Allow. The takeaway is that authentication proves who you are and authorization decides what you may do, in that order, on every single request.","diagram","16:9",[505,506,507,508,509],"Principal: user or assumed role","Authentication: prove who you are","Authorization: check every applying policy","Denied by default, explicit Deny wins","Resource: action runs only if allowed",[13,14,15,16,17],{},"/courses/aws-certified-cloud-practitioner/en/domains/02-security-and-compliance/03-identity-and-access-management/01-iam-fundamentals",{"passingScore":514,"questions":515},70,[516,525,533,543,549,554],{"question":517,"type":518,"options":519,"correctAnswer":521,"explanation":524},"What two things does IAM control?","single",[520,521,522,523],"Billing and cost allocation across accounts","Authentication (who can sign in) and authorization (what they can do)","Network routing and firewall rules for your VPC","Encryption of data at rest and in transit","IAM controls authentication, which confirms who a request comes from, and authorization, which decides what that identity is allowed to do. Billing, networking, and encryption are handled by other AWS services, even though IAM controls who may configure them.",{"question":526,"type":518,"options":527,"correctAnswer":530,"explanation":532},"Which IAM identity is meant to be assumed by whoever needs it, provides temporary credentials, and has no long-term password or access keys of its own?",[528,529,530,531],"An IAM user","An IAM group","An IAM role","A resource-based policy","A role is an identity with permissions but no permanent credentials. When a trusted principal assumes it, AWS hands out temporary security credentials for that session. A user, by contrast, has long-term credentials tied to one person or workload, and a group is just a container for users.",{"question":534,"type":535,"options":536,"correctAnswers":541,"explanation":542},"Which statements about IAM groups are correct? (Select all that apply.)","multiple",[537,538,539,540],"A group is a collection of IAM users","You can attach policies to a group to grant permissions to all its members","A group has its own credentials that you can use to sign in","Groups cannot be nested inside other groups",[537,538,540],"A group collects users so you can manage their permissions together, and policies attached to the group apply to every member. Groups have no credentials of their own, so you never sign in as a group, and you cannot place one group inside another.",{"question":544,"type":518,"options":545,"correctAnswer":546,"explanation":548},"IAM is a global service, so its users, groups, and roles are not tied to a specific AWS Region.",[546,547],"True","False","IAM is global. The identities you create are available across all Regions rather than living in one. This is why you do not pick a Region when you create an IAM user or role.",{"question":550,"type":518,"options":551,"correctAnswer":203,"explanation":553},"In a JSON policy statement, which element decides whether the listed actions are allowed or denied?",[245,224,203,552],"Principal","The Effect element is set to either Allow or Deny. Action lists the operations, Resource names what they apply to, and Principal (used in resource-based policies) names who is granted access. Effect is what flips a statement between permitting and blocking.",{"question":555,"type":518,"options":556,"correctAnswer":531,"explanation":560},"An Amazon S3 bucket policy that grants another AWS account access to the bucket is an example of which policy type?",[557,531,558,559],"An identity-based policy","A permissions boundary","A service control policy (SCP)","A resource-based policy is attached directly to a resource, such as an S3 bucket, and names the principal it grants access to. Identity-based policies attach to users, groups, or roles instead, and they never name a principal because the identity they are attached to is the principal.",{"title":7,"description":8},"courses/aws-certified-cloud-practitioner/en/domains/02-security-and-compliance/03-identity-and-access-management/01-iam-fundamentals","uUn6ozehDApSJuatCNBYwA8ne-vNcc5gFTkkir8ol_Q",{"locked":9,"reason":565,"meta":566,"item":3},"paywall",{"title":567,"description":568,"isFree":5,"estimatedMinutes":569,"difficulty":11,"learningObjectives":570},"Monitoring and Auditing","Learn how AWS CloudTrail, Amazon CloudWatch, and AWS Config work together to track API activity, monitor performance, and record resource configuration for governance and compliance.",15,[571,572,573,574],"Explain what AWS CloudTrail records and why it matters for auditing","Describe what Amazon CloudWatch monitors and how alarms work","Explain how AWS Config tracks resource configuration over time","Choose the right service for a given monitoring or auditing need",{"locked":9,"reason":565,"meta":576,"item":3},{"title":577,"description":578,"isFree":5,"estimatedMinutes":10,"difficulty":11,"learningObjectives":579},"Encryption on AWS","Learn the difference between encryption at rest and in transit, and how AWS KMS, AWS CloudHSM, and AWS Certificate Manager help you protect your data with managed keys and certificates.",[580,581,582,583],"Distinguish encryption at rest from encryption in transit","Explain what AWS KMS does and how it manages encryption keys","Compare AWS KMS with AWS CloudHSM and know when each fits","Identify AWS Certificate Manager as the service for SSL/TLS certificates"]