IAM and Access Management

Every AWS API call ends in a single decision: allow or deny. This topic is about where that decision is actually made, which is rarely the one policy you expected. A request can be shaped by an identity-based policy, a resource-based policy, a permissions boundary, a service control policy, a session policy, and a VPC endpoint policy at the same time, and only 3 of those can grant anything at all.

What This Topic Covers

• Principals, identities, and the 9 policy types AWS evaluates, plus how to read a JSON policy element by element
• Identity-based versus resource-based policies, managed versus inline, and the rule that changes when a request crosses an account boundary
• Roles as the replacement for long-lived access keys: trust policy versus permissions policy, instance profiles, service-linked roles, and the AWS STS operations that issue temporary credentials
• The AWS enforcement order, and which policy pairs combine as a union and which as an intersection
• Permissions boundaries, session policies, and why a boundary that grants nothing can still deny everything
• Condition operators and global condition keys, including the missing-key rule and the IfExists and Null forms that exist because of it
• Root user protection, account password policy limits, MFA types, and enforcing MFA through policy rather than a checkbox
• Federation with SAML 2.0 and OIDC, and choosing between IAM Identity Center, IAM federation, and Amazon Cognito
• Reading an AccessDenied message, testing with the policy simulator, and using IAM Access Analyzer, last accessed information, the credential report, and CloudTrail

Why It Matters

Exam questions in this area hand you a denied request with 4 plausible causes and ask which one fits. Answering means holding the evaluation order, not memorizing policy syntax. On the job the same skill splits a 5-minute fix from an afternoon, because the error message already names the policy type and most people never read it. The rest of the Security and Compliance domain assumes this foundation: SCPs, KMS key policies, and secret access all resolve through the same evaluation logic.