Identity and Access Management (IAM)
Learn how AWS controls who can do what: the IAM building blocks of users, groups, roles, and policies, securing the root user with least privilege, authentication and MFA, and workforce access with IAM Identity Center and federation.
Identity and Access Management is the third topic in the Security and Compliance domain. Every action in AWS comes down to one question: is this identity allowed to do this thing to this resource? IAM is the service that answers it. It controls who can sign in to your account and what each person or application may do once they are in.
The topic has 4 lessons. The first covers the IAM building blocks (users, groups, roles, and policies) and how a request is evaluated. The second covers the powerful account root user and the principle of least privilege. The third covers authentication and multi-factor authentication. The fourth covers IAM Identity Center and federation, the recommended way to give a workforce access across many accounts.
What This Topic Covers
- what IAM is, and the difference between authentication and authorization
- the four building blocks: users, groups, roles, and policies
- how AWS evaluates a request, including deny by default and the rule that an explicit deny always wins
- identity-based policies versus resource-based policies
- the account root user, the few tasks only it can do, and how to lock it down
- the principle of least privilege and starting from AWS managed policies
- ways to authenticate, multi-factor authentication, and the MFA device types AWS supports
- IAM Identity Center, permission sets, and federation with SAML 2.0 and OpenID Connect
Why It Matters
Security and Compliance is the heaviest domain on the CLF-C02 exam, and IAM carries a large part of it. Many questions test whether you can tell a user from a role, recognize a root-only task, pick the strongest MFA option, or choose IAM Identity Center over scattered IAM users. Learn the building blocks well and you can reason through these scenarios instead of guessing between similar-sounding names.
It matters in real accounts too. The first things you do in a new AWS account are securing the root user and creating proper identities for daily work. Getting IAM right, with least privilege, MFA, temporary credentials, and central sign-on, is what keeps an account safe as it grows from one person to a whole organization.