[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"lesson-aws-certified-cloudops-engineer-associate-security-and-compliance-iam-and-access-management-iam-policies-and-roles-en":4,"prev-aws-certified-cloudops-engineer-associate-security-and-compliance-iam-and-access-management-iam-policies-and-roles-en":1594,"next-aws-certified-cloudops-engineer-associate-security-and-compliance-iam-and-access-management-iam-policies-and-roles-en":1607},null,{"locked":5,"reason":3,"meta":6,"item":20},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"IAM Policies and Roles","The building blocks of every authorization decision on AWS: principals and identities, the elements of a JSON policy, identity-based versus resource-based policies, managed versus inline, and why a role carries two policies instead of one.",true,26,"intermediate",[13,14,15,16,17,18,19],"Distinguish a principal from an identity and name the policy types AWS attaches to each","Read a JSON policy statement element by element and predict what it permits","Choose between an identity-based policy and a resource-based policy for a given access requirement","Explain why an IAM role carries both a trust policy and a permissions policy, and which request each one gates","Pass a role to an EC2 instance with an instance profile and describe how the application receives credentials","Compare the AWS STS operations that issue temporary credentials by caller, lifetime, and MFA support","State what changes about policy evaluation when a request crosses an account boundary",{"id":21,"title":7,"body":22,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":1508,"infographics":1509,"isFree":9,"learningObjectives":1524,"meta":1525,"navigation":9,"path":1526,"quiz":1527,"seo":1591,"stem":1592,"__hash__":1593},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/04-security-and-compliance/01-iam-and-access-management/01-iam-policies-and-roles.md",{"type":23,"value":24,"toc":1495},"minimark",[25,29,32,37,49,59,62,170,173,177,180,454,457,539,546,550,553,564,623,630,641,645,648,670,676,679,682,686,693,705,708,711,741,746,749,869,872,1040,1049,1064,1068,1074,1081,1084,1223,1230,1234,1237,1243,1253,1256,1260,1263,1367,1370,1376,1392,1406,1410,1424,1427,1431,1438,1447,1451,1488,1491],[26,27,28],"p",{},"Your application runs on 40 EC2 instances and needs to read from an S3 bucket. The direct answer is to create an IAM user, generate an access key, and drop it into a config file on the instance. It works on the first instance. Then the key gets baked into the AMI, the AMI gets shared, someone pastes the key into a support ticket, and the rotation you scheduled for next quarter now means touching 40 machines at once. There is no expiry on that key, and nothing in AWS will ever tell you it has escaped.",[26,30,31],{},"Almost everything in this domain exists to make that pattern unnecessary. This lesson builds the vocabulary the rest of the domain assumes: what a policy is made of, which kinds of policy AWS attaches where, and why a role is the answer to the access-key problem rather than a slightly nicer wrapper around it.",[33,34,36],"h2",{"id":35},"principals-identities-and-what-a-policy-actually-is","Principals, identities, and what a policy actually is",[26,38,39,40,44,45,48],{},"A ",[41,42,43],"strong",{},"principal"," is whatever makes a request. That can be the account root user, an IAM user, a role session, or an AWS service acting on your behalf. An ",[41,46,47],{},"identity"," is the IAM object a principal comes from: a user, a group, or a role.",[26,50,39,51,54,55,58],{},[41,52,53],{},"policy"," is a JSON document that, once attached to an identity or a resource, defines permissions. When a principal sends a request, AWS collects every policy that applies and decides allow or deny. The default matters: ",[41,56,57],{},"every request is denied unless a policy allows it",", with the single exception of the root user, which has full access.",[26,60,61],{},"AWS supports 9 policy types. You will meet all of them across this domain, and you only need 3 of them for this lesson:",[63,64,65,81],"table",{},[66,67,68],"thead",{},[69,70,71,75,78],"tr",{},[72,73,74],"th",{},"Policy type",[72,76,77],{},"Attached to",[72,79,80],{},"Grants permissions?",[82,83,84,96,106,117,128,138,149,160],"tbody",{},[69,85,86,90,93],{},[87,88,89],"td",{},"Identity-based",[87,91,92],{},"User, group, or role",[87,94,95],{},"Yes",[69,97,98,101,104],{},[87,99,100],{},"Resource-based",[87,102,103],{},"A resource (bucket, queue, key, role)",[87,105,95],{},[69,107,108,111,114],{},[87,109,110],{},"Permissions boundary",[87,112,113],{},"A user or role",[87,115,116],{},"No, it caps",[69,118,119,122,125],{},[87,120,121],{},"SCP and RCP (Organizations)",[87,123,124],{},"Root, OU, or account",[87,126,127],{},"No, they cap",[69,129,130,133,136],{},[87,131,132],{},"Session policy",[87,134,135],{},"Passed at session creation",[87,137,116],{},[69,139,140,143,146],{},[87,141,142],{},"VPC endpoint policy",[87,144,145],{},"A VPC endpoint",[87,147,148],{},"No, it caps traffic through the endpoint",[69,150,151,154,157],{},[87,152,153],{},"ACL",[87,155,156],{},"A resource, non-JSON syntax",[87,158,159],{},"Yes, cross-account only",[69,161,162,165,168],{},[87,163,164],{},"AWS RAM resource share",[87,166,167],{},"A shared resource",[87,169,95],{},[26,171,172],{},"Notice the third column. Only 3 of these types actually hand out permissions. The rest set ceilings, which is why \"the policy allows it\" and \"the request succeeds\" are different statements. The next lesson is entirely about the difference.",[33,174,176],{"id":175},"the-anatomy-of-a-json-policy","The anatomy of a JSON policy",[26,178,179],{},"Every JSON policy has optional top-level information and one or more statements. AWS applies a logical OR across the statements in a policy and across all the policies that apply, so any single allow is enough (unless something denies).",[181,182,187],"pre",{"className":183,"code":184,"language":185,"meta":186,"style":186},"language-json shiki shiki-themes material-theme-lighter github-light github-dark","{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"ReadReportsBucket\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"s3:GetObject\",\n        \"s3:ListBucket\"\n      ],\n      \"Resource\": [\n        \"arn:aws:s3:::finance-reports\",\n        \"arn:aws:s3:::finance-reports/*\"\n      ],\n      \"Condition\": {\n        \"Bool\": { \"aws:SecureTransport\": \"true\" }\n      }\n    }\n  ]\n}\n","json","",[188,189,190,199,229,244,250,273,294,308,321,332,338,352,364,374,379,394,430,436,442,448],"code",{"__ignoreMap":186},[191,192,195],"span",{"class":193,"line":194},"line",1,[191,196,198],{"class":197},"sP7_E","{\n",[191,200,202,206,210,213,216,220,224,226],{"class":193,"line":201},2,[191,203,205],{"class":204},"s39Yj","  \"",[191,207,209],{"class":208},"sseR_","Version",[191,211,212],{"class":204},"\"",[191,214,215],{"class":197},":",[191,217,219],{"class":218},"sjJ54"," \"",[191,221,223],{"class":222},"s_sjI","2012-10-17",[191,225,212],{"class":218},[191,227,228],{"class":197},",\n",[191,230,232,234,237,239,241],{"class":193,"line":231},3,[191,233,205],{"class":204},[191,235,236],{"class":208},"Statement",[191,238,212],{"class":204},[191,240,215],{"class":197},[191,242,243],{"class":197}," [\n",[191,245,247],{"class":193,"line":246},4,[191,248,249],{"class":197},"    {\n",[191,251,253,256,260,262,264,266,269,271],{"class":193,"line":252},5,[191,254,255],{"class":204},"      \"",[191,257,259],{"class":258},"sZMiF","Sid",[191,261,212],{"class":204},[191,263,215],{"class":197},[191,265,219],{"class":218},[191,267,268],{"class":222},"ReadReportsBucket",[191,270,212],{"class":218},[191,272,228],{"class":197},[191,274,276,278,281,283,285,287,290,292],{"class":193,"line":275},6,[191,277,255],{"class":204},[191,279,280],{"class":258},"Effect",[191,282,212],{"class":204},[191,284,215],{"class":197},[191,286,219],{"class":218},[191,288,289],{"class":222},"Allow",[191,291,212],{"class":218},[191,293,228],{"class":197},[191,295,297,299,302,304,306],{"class":193,"line":296},7,[191,298,255],{"class":204},[191,300,301],{"class":258},"Action",[191,303,212],{"class":204},[191,305,215],{"class":197},[191,307,243],{"class":197},[191,309,311,314,317,319],{"class":193,"line":310},8,[191,312,313],{"class":218},"        \"",[191,315,316],{"class":222},"s3:GetObject",[191,318,212],{"class":218},[191,320,228],{"class":197},[191,322,324,326,329],{"class":193,"line":323},9,[191,325,313],{"class":218},[191,327,328],{"class":222},"s3:ListBucket",[191,330,331],{"class":218},"\"\n",[191,333,335],{"class":193,"line":334},10,[191,336,337],{"class":197},"      ],\n",[191,339,341,343,346,348,350],{"class":193,"line":340},11,[191,342,255],{"class":204},[191,344,345],{"class":258},"Resource",[191,347,212],{"class":204},[191,349,215],{"class":197},[191,351,243],{"class":197},[191,353,355,357,360,362],{"class":193,"line":354},12,[191,356,313],{"class":218},[191,358,359],{"class":222},"arn:aws:s3:::finance-reports",[191,361,212],{"class":218},[191,363,228],{"class":197},[191,365,367,369,372],{"class":193,"line":366},13,[191,368,313],{"class":218},[191,370,371],{"class":222},"arn:aws:s3:::finance-reports/*",[191,373,331],{"class":218},[191,375,377],{"class":193,"line":376},14,[191,378,337],{"class":197},[191,380,382,384,387,389,391],{"class":193,"line":381},15,[191,383,255],{"class":204},[191,385,386],{"class":258},"Condition",[191,388,212],{"class":204},[191,390,215],{"class":197},[191,392,393],{"class":197}," {\n",[191,395,397,399,403,405,407,410,412,416,418,420,422,425,427],{"class":193,"line":396},16,[191,398,313],{"class":204},[191,400,402],{"class":401},"srdBf","Bool",[191,404,212],{"class":204},[191,406,215],{"class":197},[191,408,409],{"class":197}," {",[191,411,219],{"class":204},[191,413,415],{"class":414},"swQdS","aws:SecureTransport",[191,417,212],{"class":204},[191,419,215],{"class":197},[191,421,219],{"class":218},[191,423,424],{"class":222},"true",[191,426,212],{"class":218},[191,428,429],{"class":197}," }\n",[191,431,433],{"class":193,"line":432},17,[191,434,435],{"class":197},"      }\n",[191,437,439],{"class":193,"line":438},18,[191,440,441],{"class":197},"    }\n",[191,443,445],{"class":193,"line":444},19,[191,446,447],{"class":197},"  ]\n",[191,449,451],{"class":193,"line":450},20,[191,452,453],{"class":197},"}\n",[26,455,456],{},"The elements, and the traps in each:",[458,459,460,471,478,492,507,522,532],"ul",{},[461,462,463,467,468,470],"li",{},[41,464,465],{},[188,466,209],{}," is the policy language version, not a version of your policy. Use ",[188,469,223],{},". An older or missing value silently disables policy variables.",[461,472,473,477],{},[41,474,475],{},[188,476,259],{}," is an optional label. It has no effect on evaluation, but it is what shows up when you are hunting for the statement that denied something, so name them.",[461,479,480,484,485,487,488,491],{},[41,481,482],{},[188,483,280],{}," is ",[188,486,289],{}," or ",[188,489,490],{},"Deny",".",[461,493,494,499,500,503,504,506],{},[41,495,496],{},[188,497,498],{},"Principal"," names who the policy applies to. It is required in a resource-based policy and ",[41,501,502],{},"forbidden in an identity-based policy",", where the principal is implied by whatever the policy is attached to. Seeing a ",[188,505,498],{}," block tells you immediately which kind of policy you are reading.",[461,508,509,513,514,517,518,521],{},[41,510,511],{},[188,512,301],{}," lists service actions in ",[188,515,516],{},"service:Operation"," form, with ",[188,519,520],{},"*"," allowed.",[461,523,524,528,529,531],{},[41,525,526],{},[188,527,345],{}," lists ARNs. The bucket and the objects inside it are 2 different ARNs, which is why the example above lists both. A policy with only ",[188,530,359],{}," allows listing but not reading a single object.",[461,533,534,538],{},[41,535,536],{},[188,537,386],{}," makes the statement apply only when the condition is true. Conditions are the subject of the next lesson.",[26,540,541,542,545],{},"One rule worth internalizing now: ",[41,543,544],{},"a statement with no matching condition simply does not apply",". It does not deny; it drops out of the evaluation and leaves the request to whatever else allows it, which is usually nothing.",[33,547,549],{"id":548},"identity-based-versus-resource-based-policies","Identity-based versus resource-based policies",[26,551,552],{},"Both grant permissions. They differ in which question they answer.",[26,554,555,556,559,560,563],{},"An identity-based policy answers ",[41,557,558],{},"\"what can this identity do?\""," and lives on the user, group, or role. A resource-based policy answers ",[41,561,562],{},"\"who can touch this resource?\""," and lives on the resource: an S3 bucket policy, an SQS queue policy, a KMS key policy, a Lambda function policy, an IAM role trust policy.",[63,565,566,576],{},[66,567,568],{},[69,569,570,572,574],{},[72,571],{},[72,573,89],{},[72,575,100],{},[82,577,578,588,601,612],{},[69,579,580,582,585],{},[87,581,77],{},[87,583,584],{},"User, group, role",[87,586,587],{},"The resource itself",[69,589,590,595,598],{},[87,591,592,594],{},[188,593,498],{}," element",[87,596,597],{},"Not allowed",[87,599,600],{},"Required",[69,602,603,606,609],{},[87,604,605],{},"Managed or inline",[87,607,608],{},"Both",[87,610,611],{},"Inline only, there are no managed resource-based policies",[69,613,614,617,620],{},[87,615,616],{},"Cross-account",[87,618,619],{},"Names the resource in another account",[87,621,622],{},"Names the principal in another account",[26,624,625,626,629],{},"Within one account the two are ",[41,627,628],{},"unioned",": an allow in either is enough, and an explicit deny in either wins. That is why Zhang, with no identity-based policy at all, can still read a queue whose queue policy names him.",[26,631,632,633,636,637,640],{},"Two exceptions are worth memorizing because the exam likes them. ",[41,634,635],{},"IAM role trust policies and KMS key policies must explicitly allow the principal."," The union shortcut does not save you there: an identity-based policy granting ",[188,638,639],{},"kms:Decrypt"," on a key whose key policy never mentions you is not enough.",[33,642,644],{"id":643},"managed-versus-inline-policies","Managed versus inline policies",[26,646,647],{},"Identity-based policies come in 2 forms, and the choice is about reuse and lifecycle rather than power.",[26,649,650,653,654,657,658,661,662,665,666,669],{},[41,651,652],{},"Managed policies"," are standalone objects you attach to many identities. ",[41,655,656],{},"AWS managed policies"," are written and maintained by AWS (",[188,659,660],{},"AmazonS3ReadOnlyAccess",", ",[188,663,664],{},"AdministratorAccess",", and the job-function policies). ",[41,667,668],{},"Customer managed policies"," are yours. Edit one and every attachment changes at once.",[26,671,672,675],{},[41,673,674],{},"Inline policies"," are embedded directly in a single user, group, or role. They have a strict one-to-one relationship with that identity and are deleted when it is deleted.",[26,677,678],{},"AWS's own guidance is to start with AWS managed policies for a working baseline and then narrow to customer managed policies as you learn which permissions the workload actually uses. AWS managed policies are written to be useful for every AWS customer, which is exactly why they are rarely least privilege for yours.",[26,680,681],{},"Use inline when the permission must never outlive the identity, or when you want to guarantee nobody accidentally attaches it somewhere else.",[33,683,685],{"id":684},"roles-two-policies-two-questions","Roles: two policies, two questions",[26,687,688,689,692],{},"Here is the concept that carries the rest of the domain. A ",[41,690,691],{},"role"," is an identity with permissions, like a user, but with 2 differences that change everything:",[694,695,696,699],"ol",{},[461,697,698],{},"It is not tied to one person. Anyone or anything allowed by the role can assume it.",[461,700,701,704],{},[41,702,703],{},"It has no long-term credentials."," No password, no access key. Assuming a role produces temporary credentials that expire.",[26,706,707],{},"That second point is what solves the opening problem. Nothing to bake into an AMI, nothing to rotate, nothing to leak permanently.",[26,709,710],{},"To make that work, a role carries 2 policies that gate 2 different requests:",[458,712,713,731],{},[461,714,715,716,719,720,723,724,727,728,730],{},"The ",[41,717,718],{},"trust policy"," is a resource-based policy on the role. It answers ",[41,721,722],{},"who may become this role",". It is the only thing consulted when someone calls ",[188,725,726],{},"sts:AssumeRole",". Wildcards are not allowed in an ARN in the ",[188,729,498],{}," element of a trust policy.",[461,732,715,733,736,737,740],{},[41,734,735],{},"permissions policy"," is an identity-based policy on the role. It answers ",[41,738,739],{},"what the resulting session may do",". It is never consulted during the assume-role call.",[742,743],"infographic",{"alt":744,"slug":745},"A two-gate flow shows an assume-role request passing the trust policy to create a temporary session, which then passes the permissions policy to make the real API call, with each gate producing a different denial message.","iam-role-two-gates",[26,747,748],{},"A minimal trust policy for an EC2 workload:",[181,750,752],{"className":183,"code":751,"language":185,"meta":186,"style":186},"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": { \"Service\": \"ec2.amazonaws.com\" },\n      \"Action\": \"sts:AssumeRole\"\n    }\n  ]\n}\n",[188,753,754,758,776,788,792,810,841,857,861,865],{"__ignoreMap":186},[191,755,756],{"class":193,"line":194},[191,757,198],{"class":197},[191,759,760,762,764,766,768,770,772,774],{"class":193,"line":201},[191,761,205],{"class":204},[191,763,209],{"class":208},[191,765,212],{"class":204},[191,767,215],{"class":197},[191,769,219],{"class":218},[191,771,223],{"class":222},[191,773,212],{"class":218},[191,775,228],{"class":197},[191,777,778,780,782,784,786],{"class":193,"line":231},[191,779,205],{"class":204},[191,781,236],{"class":208},[191,783,212],{"class":204},[191,785,215],{"class":197},[191,787,243],{"class":197},[191,789,790],{"class":193,"line":246},[191,791,249],{"class":197},[191,793,794,796,798,800,802,804,806,808],{"class":193,"line":252},[191,795,255],{"class":204},[191,797,280],{"class":258},[191,799,212],{"class":204},[191,801,215],{"class":197},[191,803,219],{"class":218},[191,805,289],{"class":222},[191,807,212],{"class":218},[191,809,228],{"class":197},[191,811,812,814,816,818,820,822,824,827,829,831,833,836,838],{"class":193,"line":275},[191,813,255],{"class":204},[191,815,498],{"class":258},[191,817,212],{"class":204},[191,819,215],{"class":197},[191,821,409],{"class":197},[191,823,219],{"class":204},[191,825,826],{"class":401},"Service",[191,828,212],{"class":204},[191,830,215],{"class":197},[191,832,219],{"class":218},[191,834,835],{"class":222},"ec2.amazonaws.com",[191,837,212],{"class":218},[191,839,840],{"class":197}," },\n",[191,842,843,845,847,849,851,853,855],{"class":193,"line":296},[191,844,255],{"class":204},[191,846,301],{"class":258},[191,848,212],{"class":204},[191,850,215],{"class":197},[191,852,219],{"class":218},[191,854,726],{"class":222},[191,856,331],{"class":218},[191,858,859],{"class":193,"line":310},[191,860,441],{"class":197},[191,862,863],{"class":193,"line":323},[191,864,447],{"class":197},[191,866,867],{"class":193,"line":334},[191,868,453],{"class":197},[26,870,871],{},"And for a cross-account human:",[181,873,875],{"className":183,"code":874,"language":185,"meta":186,"style":186},"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": { \"AWS\": \"arn:aws:iam::111122223333:root\" },\n      \"Action\": \"sts:AssumeRole\",\n      \"Condition\": {\n        \"StringEquals\": { \"sts:ExternalId\": \"a1b2c3d4-audit-2026\" }\n      }\n    }\n  ]\n}\n",[188,876,877,881,899,911,915,933,963,981,993,1024,1028,1032,1036],{"__ignoreMap":186},[191,878,879],{"class":193,"line":194},[191,880,198],{"class":197},[191,882,883,885,887,889,891,893,895,897],{"class":193,"line":201},[191,884,205],{"class":204},[191,886,209],{"class":208},[191,888,212],{"class":204},[191,890,215],{"class":197},[191,892,219],{"class":218},[191,894,223],{"class":222},[191,896,212],{"class":218},[191,898,228],{"class":197},[191,900,901,903,905,907,909],{"class":193,"line":231},[191,902,205],{"class":204},[191,904,236],{"class":208},[191,906,212],{"class":204},[191,908,215],{"class":197},[191,910,243],{"class":197},[191,912,913],{"class":193,"line":246},[191,914,249],{"class":197},[191,916,917,919,921,923,925,927,929,931],{"class":193,"line":252},[191,918,255],{"class":204},[191,920,280],{"class":258},[191,922,212],{"class":204},[191,924,215],{"class":197},[191,926,219],{"class":218},[191,928,289],{"class":222},[191,930,212],{"class":218},[191,932,228],{"class":197},[191,934,935,937,939,941,943,945,947,950,952,954,956,959,961],{"class":193,"line":275},[191,936,255],{"class":204},[191,938,498],{"class":258},[191,940,212],{"class":204},[191,942,215],{"class":197},[191,944,409],{"class":197},[191,946,219],{"class":204},[191,948,949],{"class":401},"AWS",[191,951,212],{"class":204},[191,953,215],{"class":197},[191,955,219],{"class":218},[191,957,958],{"class":222},"arn:aws:iam::111122223333:root",[191,960,212],{"class":218},[191,962,840],{"class":197},[191,964,965,967,969,971,973,975,977,979],{"class":193,"line":296},[191,966,255],{"class":204},[191,968,301],{"class":258},[191,970,212],{"class":204},[191,972,215],{"class":197},[191,974,219],{"class":218},[191,976,726],{"class":222},[191,978,212],{"class":218},[191,980,228],{"class":197},[191,982,983,985,987,989,991],{"class":193,"line":310},[191,984,255],{"class":204},[191,986,386],{"class":258},[191,988,212],{"class":204},[191,990,215],{"class":197},[191,992,393],{"class":197},[191,994,995,997,1000,1002,1004,1006,1008,1011,1013,1015,1017,1020,1022],{"class":193,"line":323},[191,996,313],{"class":204},[191,998,999],{"class":401},"StringEquals",[191,1001,212],{"class":204},[191,1003,215],{"class":197},[191,1005,409],{"class":197},[191,1007,219],{"class":204},[191,1009,1010],{"class":414},"sts:ExternalId",[191,1012,212],{"class":204},[191,1014,215],{"class":197},[191,1016,219],{"class":218},[191,1018,1019],{"class":222},"a1b2c3d4-audit-2026",[191,1021,212],{"class":218},[191,1023,429],{"class":197},[191,1025,1026],{"class":193,"line":334},[191,1027,435],{"class":197},[191,1029,1030],{"class":193,"line":340},[191,1031,441],{"class":197},[191,1033,1034],{"class":193,"line":354},[191,1035,447],{"class":197},[191,1037,1038],{"class":193,"line":366},[191,1039,453],{"class":197},[26,1041,715,1042,1044,1045,1048],{},[188,1043,1010],{}," condition is the standard defense against the ",[41,1046,1047],{},"confused deputy"," problem. When you give a third party (an auditor, a monitoring vendor) a role in your account, they hold roles for many customers. Without an external ID, a customer who learns your role ARN could ask the vendor to assume it on their behalf. The external ID is a secret you and the vendor share, and it makes the trust policy specific to your relationship rather than to the vendor as a whole.",[26,1050,1051,1052,1055,1056,1059,1060,1063],{},"This is also the single most useful diagnostic split in IAM. ",[41,1053,1054],{},"The 2 gates fail with different error messages."," ",[188,1057,1058],{},"not authorized to perform: sts:AssumeRole"," points at the trust policy. ",[188,1061,1062],{},"not authorized to perform: s3:GetObject"," points at the permissions policy. The last lesson in this topic turns that observation into a full procedure.",[33,1065,1067],{"id":1066},"how-a-role-reaches-an-ec2-instance-the-instance-profile","How a role reaches an EC2 instance: the instance profile",[26,1069,1070,1071,491],{},"A role is an IAM object. EC2 needs a container to attach it to, and that container is an ",[41,1072,1073],{},"instance profile",[26,1075,1076,1077,1080],{},"The rule that produces exam questions: ",[41,1078,1079],{},"an instance profile can contain only 1 IAM role",", and that limit cannot be raised. A role can appear in many instance profiles, but never the reverse.",[26,1082,1083],{},"Where the confusion starts is that the console hides the object. Create a role for EC2 in the console and it creates an instance profile with the same name automatically. Create the same role from the CLI or the API and you get a role and nothing else, so the launch wizard (which lists instance profile names, not role names) shows you nothing.",[181,1085,1089],{"className":1086,"code":1087,"language":1088,"meta":186,"style":186},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","# from the CLI, these are 3 separate steps\naws iam create-role \\\n  --role-name AppServerRole \\\n  --assume-role-policy-document file://trust-policy.json\n\naws iam create-instance-profile --instance-profile-name AppServerProfile\n\naws iam add-role-to-instance-profile \\\n  --instance-profile-name AppServerProfile \\\n  --role-name AppServerRole\n\n# attach to a running instance\naws ec2 associate-iam-instance-profile \\\n  --instance-id i-02573cafcfEXAMPLE \\\n  --iam-instance-profile Name=AppServerProfile\n","bash",[188,1090,1091,1097,1113,1124,1132,1137,1152,1156,1167,1177,1184,1188,1193,1205,1215],{"__ignoreMap":186},[191,1092,1093],{"class":193,"line":194},[191,1094,1096],{"class":1095},"sutJx","# from the CLI, these are 3 separate steps\n",[191,1098,1099,1103,1106,1109],{"class":193,"line":201},[191,1100,1102],{"class":1101},"sbgvK","aws",[191,1104,1105],{"class":222}," iam",[191,1107,1108],{"class":222}," create-role",[191,1110,1112],{"class":1111},"s_hVV"," \\\n",[191,1114,1115,1119,1122],{"class":193,"line":231},[191,1116,1118],{"class":1117},"stzsN","  --role-name",[191,1120,1121],{"class":222}," AppServerRole",[191,1123,1112],{"class":1111},[191,1125,1126,1129],{"class":193,"line":246},[191,1127,1128],{"class":1117},"  --assume-role-policy-document",[191,1130,1131],{"class":222}," file://trust-policy.json\n",[191,1133,1134],{"class":193,"line":252},[191,1135,1136],{"emptyLinePlaceholder":9},"\n",[191,1138,1139,1141,1143,1146,1149],{"class":193,"line":275},[191,1140,1102],{"class":1101},[191,1142,1105],{"class":222},[191,1144,1145],{"class":222}," create-instance-profile",[191,1147,1148],{"class":1117}," --instance-profile-name",[191,1150,1151],{"class":222}," AppServerProfile\n",[191,1153,1154],{"class":193,"line":296},[191,1155,1136],{"emptyLinePlaceholder":9},[191,1157,1158,1160,1162,1165],{"class":193,"line":310},[191,1159,1102],{"class":1101},[191,1161,1105],{"class":222},[191,1163,1164],{"class":222}," add-role-to-instance-profile",[191,1166,1112],{"class":1111},[191,1168,1169,1172,1175],{"class":193,"line":323},[191,1170,1171],{"class":1117},"  --instance-profile-name",[191,1173,1174],{"class":222}," AppServerProfile",[191,1176,1112],{"class":1111},[191,1178,1179,1181],{"class":193,"line":334},[191,1180,1118],{"class":1117},[191,1182,1183],{"class":222}," AppServerRole\n",[191,1185,1186],{"class":193,"line":340},[191,1187,1136],{"emptyLinePlaceholder":9},[191,1189,1190],{"class":193,"line":354},[191,1191,1192],{"class":1095},"# attach to a running instance\n",[191,1194,1195,1197,1200,1203],{"class":193,"line":366},[191,1196,1102],{"class":1101},[191,1198,1199],{"class":222}," ec2",[191,1201,1202],{"class":222}," associate-iam-instance-profile",[191,1204,1112],{"class":1111},[191,1206,1207,1210,1213],{"class":193,"line":376},[191,1208,1209],{"class":1117},"  --instance-id",[191,1211,1212],{"class":222}," i-02573cafcfEXAMPLE",[191,1214,1112],{"class":1111},[191,1216,1217,1220],{"class":193,"line":381},[191,1218,1219],{"class":1117},"  --iam-instance-profile",[191,1221,1222],{"class":222}," Name=AppServerProfile\n",[26,1224,1225,1226,1229],{},"Once attached, the AWS SDKs on the instance find the credentials through the instance metadata service without any configuration, and the service rotates them before they expire. To change what an instance can do, ",[41,1227,1228],{},"replace the instance profile rather than swapping the role inside it",": removing a role from an instance profile takes up to an hour to take effect, because the change has to propagate.",[33,1231,1233],{"id":1232},"service-roles-and-service-linked-roles","Service roles and service-linked roles",[26,1235,1236],{},"Two role flavors carry names the exam uses precisely.",[26,1238,39,1239,1242],{},[41,1240,1241],{},"service role"," is a role that an AWS service assumes to act on your behalf. You create it, you write its trust policy naming the service principal, and you can edit its permissions. A CodeBuild build role and the EC2 role above are service roles.",[26,1244,39,1245,1248,1249,1252],{},[41,1246,1247],{},"service-linked role"," is created and owned by the service. It appears in your account, its permissions are defined by the service, and ",[41,1250,1251],{},"an administrator can view but not edit them",". You also cannot delete it until you delete the resources that depend on it, which is a guard against orphaning resources the service can no longer manage.",[26,1254,1255],{},"If a question hands you a role you did not create and asks why its policy cannot be tightened, it is a service-linked role.",[33,1257,1259],{"id":1258},"getting-temporary-credentials-the-sts-operations","Getting temporary credentials: the STS operations",[26,1261,1262],{},"AWS Security Token Service issues every temporary credential on AWS. The 5 operations differ by who can call them and how long the result lives.",[63,1264,1265,1283],{},[66,1266,1267],{},[69,1268,1269,1272,1275,1278,1281],{},[72,1270,1271],{},"Operation",[72,1273,1274],{},"Who can call",[72,1276,1277],{},"Lifetime (min, max, default)",[72,1279,1280],{},"MFA input",[72,1282,132],{},[82,1284,1285,1302,1319,1335,1352],{},[69,1286,1287,1292,1295,1298,1300],{},[87,1288,1289],{},[188,1290,1291],{},"AssumeRole",[87,1293,1294],{},"IAM user or a role with existing temporary credentials",[87,1296,1297],{},"15 min, role max session duration, 1 hr",[87,1299,95],{},[87,1301,95],{},[69,1303,1304,1309,1312,1314,1317],{},[87,1305,1306],{},[188,1307,1308],{},"AssumeRoleWithSAML",[87,1310,1311],{},"Anyone with a SAML response from a known IdP",[87,1313,1297],{},[87,1315,1316],{},"No",[87,1318,95],{},[69,1320,1321,1326,1329,1331,1333],{},[87,1322,1323],{},[188,1324,1325],{},"AssumeRoleWithWebIdentity",[87,1327,1328],{},"Anyone with an OIDC JWT from a known IdP",[87,1330,1297],{},[87,1332,1316],{},[87,1334,95],{},[69,1336,1337,1342,1345,1348,1350],{},[87,1338,1339],{},[188,1340,1341],{},"GetFederationToken",[87,1343,1344],{},"IAM user or root user",[87,1346,1347],{},"IAM user: 15 min, 36 hr, 12 hr. Root: 15 min, 1 hr, 1 hr",[87,1349,1316],{},[87,1351,95],{},[69,1353,1354,1359,1361,1363,1365],{},[87,1355,1356],{},[188,1357,1358],{},"GetSessionToken",[87,1360,1344],{},[87,1362,1347],{},[87,1364,95],{},[87,1366,1316],{},[26,1368,1369],{},"Three details decide questions here.",[26,1371,715,1372,1375],{},[41,1373,1374],{},"maximum session duration setting on the role"," is the ceiling for every assume-role variant, configurable up to 12 hours. Ask for more than the role allows and the call fails rather than returning a shorter session.",[26,1377,1378,1387,1388,1391],{},[41,1379,1380,1381,1383,1384,1386],{},"Only ",[188,1382,1291],{}," and ",[188,1385,1358],{}," accept MFA information."," That is what makes ",[188,1389,1390],{},"aws:MultiFactorAuthPresent"," true for the resulting session, which the next lesson uses to enforce MFA on sensitive actions.",[26,1393,1394,1399,1400,1402,1403,1405],{},[41,1395,1396,1398],{},[188,1397,1358],{}," cannot sign you in to the console"," through the federation endpoint, while ",[188,1401,1341],{}," can. If a scenario needs single sign-on to the console from a custom identity broker, ",[188,1404,1341],{}," is the operation.",[33,1407,1409],{"id":1408},"role-chaining-and-session-duration","Role chaining and session duration",[26,1411,1412,1415,1416,1419,1420,1423],{},[41,1413,1414],{},"Role chaining"," is using one role's credentials to assume a second role. It is common in pipelines and cross-account tooling, and it carries a hard limit: ",[41,1417,1418],{},"a chained session is capped at 1 hour",", regardless of the maximum session duration configured on the target role. Passing ",[188,1421,1422],{},"DurationSeconds"," greater than 3600 on a chained call makes the operation fail.",[26,1425,1426],{},"It is tempting to read that as \"the session gets truncated to an hour.\" It does not. The call errors out, which is why a pipeline that worked with a 4-hour session from a user's credentials breaks the day someone inserts an intermediate role.",[33,1428,1430],{"id":1429},"cross-account-access-the-rule-that-changes","Cross-account access: the rule that changes",[26,1432,1433,1434,1437],{},"Inside one account, identity-based and resource-based policies are unioned. ",[41,1435,1436],{},"Across accounts, both sides must allow the request."," The principal's account must grant an identity-based allow for the action on the target resource, and the resource's account must name that principal in a resource-based policy or a role trust policy. One side alone always fails.",[26,1439,1440,1441,1443,1444,1446],{},"That single asymmetry explains most cross-account tickets. A bucket policy that generously allows ",[188,1442,958],{}," does nothing until an administrator in account 111122223333 also grants some identity the matching ",[188,1445,316],{}," permission. Naming the account root in a bucket policy delegates to that account; it does not grant to every principal in it.",[33,1448,1450],{"id":1449},"exam-tips","Exam tips",[458,1452,1453,1461,1464,1467,1473,1476,1482,1485],{},[461,1454,1455,1457,1458,1460],{},[188,1456,498],{}," in the policy means it is a resource-based policy. No ",[188,1459,498],{}," means identity-based. That one element identifies the policy type faster than reading the rest.",[461,1462,1463],{},"\"Application on EC2 needs to call an AWS service\" always means an instance profile with a role, never an access key on the instance.",[461,1465,1466],{},"1 role per instance profile, and a role can live in many instance profiles. Removing a role from an instance profile takes up to 1 hour, so the fix in a scenario is to replace the instance profile.",[461,1468,1469,1470,1472],{},"Two error messages, two policies: ",[188,1471,726],{}," denied means the trust policy, the target action denied means the permissions policy.",[461,1474,1475],{},"Role chaining caps at 1 hour and fails rather than truncating.",[461,1477,1478,1479,1481],{},"The words \"third party\", \"vendor\", or \"auditor\" in a cross-account role scenario point at ",[188,1480,1010],{}," and the confused deputy problem.",[461,1483,1484],{},"Cross-account needs an allow on both sides. Same-account needs an allow on either side, except for role trust policies and KMS key policies, which must name the principal.",[461,1486,1487],{},"A role whose permissions you cannot edit is a service-linked role.",[26,1489,1490],{},"The rule to carry out of this lesson: on AWS, credentials should have an expiry, and the way you get an expiry is a role. Everything else here is bookkeeping around that one idea. The next lesson takes the policies you can now read and answers the harder question of what happens when 5 of them apply to the same request and disagree.",[1492,1493,1494],"style",{},"html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s39Yj, html code.shiki .s39Yj{--shiki-light:#39ADB5;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sseR_, html code.shiki .sseR_{--shiki-light:#9C3EDA;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sZMiF, html code.shiki .sZMiF{--shiki-light:#E2931D;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .swQdS, html code.shiki .swQdS{--shiki-light:#E53935;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":186,"searchDepth":231,"depth":231,"links":1496},[1497,1498,1499,1500,1501,1502,1503,1504,1505,1506,1507],{"id":35,"depth":201,"text":36},{"id":175,"depth":201,"text":176},{"id":548,"depth":201,"text":549},{"id":643,"depth":201,"text":644},{"id":684,"depth":201,"text":685},{"id":1066,"depth":201,"text":1067},{"id":1232,"depth":201,"text":1233},{"id":1258,"depth":201,"text":1259},{"id":1408,"depth":201,"text":1409},{"id":1429,"depth":201,"text":1430},{"id":1449,"depth":201,"text":1450},"md",[1510],{"slug":745,"concept":1511,"style":1512,"aspectRatio":1513,"labels":1514},"A left-to-right flow showing that using an IAM role means passing two separate policy gates. On the left, a principal (an IAM user, another role, or an AWS service) sends an sts:AssumeRole request. Gate 1 is the role's trust policy, which answers who may become this role, and a failure here returns an AssumeRole denial. Passing it produces a temporary role session, drawn as a small credentials box with an expiry. That session then sends the real service API call into Gate 2, the role's permissions policy, which answers what the session may do, and a failure here returns an ordinary AccessDenied on the target action. The emphasis is that the two gates fail with different error messages, so the message itself names the policy to open.","diagram","16:9",[1515,1516,1517,1518,1519,1520,1521,1522,1523],"Principal: an IAM user, another role, or an AWS service","Request 1: sts:AssumeRole","Gate 1, trust policy: who is allowed to become this role","Denied here: not authorized to perform sts:AssumeRole","Role session: temporary credentials that expire at the session duration","Request 2: the real API call, for example s3:GetObject","Gate 2, permissions policy: what the session is allowed to do","Denied here: not authorized to perform s3:GetObject","Two gates produce two different denial messages, so the error names the policy you have to fix.",[13,14,15,16,17,18,19],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/04-security-and-compliance/01-iam-and-access-management/01-iam-policies-and-roles",{"passingScore":1528,"questions":1529},70,[1530,1539,1547,1557,1565,1573,1577,1583],{"question":1531,"type":1532,"options":1533,"correctAnswer":1535,"explanation":1538},"A team creates an IAM role from the AWS CLI and then cannot select it when launching an EC2 instance in the console. What is the most likely cause?","single",[1534,1535,1536,1537],"The role's trust policy names ec2.amazonaws.com, which the console does not support","No instance profile was created, because the CLI treats roles and instance profiles as separate resources","The role has no permissions policy attached yet, so the console hides it","EC2 requires the role to be created in the same Region as the instance","The console creates an instance profile automatically and gives it the same name as the role, which is why the problem never appears there. From the CLI or API, `create-role` and `create-instance-profile` are separate calls, and the EC2 launch list is a list of instance profile names, not role names. A missing permissions policy would produce an empty-permissions role that still appears in the list.",{"question":1540,"type":1532,"options":1541,"correctAnswer":1542,"explanation":1546},"An engineer's IAM user has AdministratorAccess. They run `aws sts assume-role` against a role in the same account and get: not authorized to perform: sts:AssumeRole. Which policy do you open first?",[1542,1543,1544,1545],"The role's trust policy, because it decides who is allowed to assume the role","The role's permissions policy, because it decides what the role can do","The user's identity-based policy, because AdministratorAccess may exclude STS","The account password policy, because assume-role requires a current password","A role carries two policies that gate two different requests. The trust policy is a resource-based policy on the role, and it is the only thing that decides whether `sts:AssumeRole` succeeds; the permissions policy is not consulted until the session exists and makes a real API call. Because the failing action is `sts:AssumeRole` and not the target action, the denial is at the first gate.",{"question":1548,"type":1549,"options":1550,"correctAnswers":1555,"explanation":1556},"An IAM role in account A must read objects from an S3 bucket in account B. Which two things must both be true? (Choose 2.)","multiple",[1551,1552,1553,1554],"The role in account A must have an identity-based policy allowing s3:GetObject on the bucket","The bucket policy in account B must allow the role in account A","The bucket must be in the same Region as the role","Account B must grant account A a permissions boundary that allows s3:GetObject",[1551,1552],"Inside one account, an allow in either the identity-based policy or the resource-based policy is enough, because the two are unioned. Across accounts that shortcut disappears: both sides must allow the request independently, or it fails. Permissions boundaries never grant anything and cannot be handed to another account, and IAM policies are not Region-scoped.",{"question":1558,"type":1532,"options":1559,"correctAnswer":1563,"explanation":1564},"A pipeline assumes RoleA with a user's long-term keys, then uses RoleA's credentials to assume RoleB with DurationSeconds set to 4 hours. RoleB's maximum session duration is 12 hours. What happens?",[1560,1561,1562,1563],"The session is issued for 12 hours, because the role setting overrides the request","The session is issued for 4 hours, because it is below RoleB's maximum","The session is issued for 1 hour, silently truncated","The operation fails, because role chaining caps a session at 1 hour","Using one role's credentials to assume a second role is role chaining, and it limits the session to a maximum of 1 hour regardless of the maximum session duration configured on the role. AWS does not silently truncate the value: passing a `DurationSeconds` greater than 1 hour on a chained assume-role makes the operation fail outright.",{"question":1566,"type":1532,"options":1567,"correctAnswer":1570,"explanation":1572},"Zhang has no identity-based policy at all. The resource-based policy on an SQS queue in the same account names his IAM user ARN and allows sqs:ReceiveMessage. Can he receive messages?",[1568,1569,1570,1571],"No, because every request needs an explicit allow in an identity-based policy","No, unless an administrator also attaches an inline policy to his user","Yes, because within one account an allow in either policy type is enough","Yes, but only for 1 hour after the resource policy is saved","Within a single account, identity-based and resource-based policies are unioned, so an allow in either one grants the request. IAM role trust policies and KMS key policies are the notable exceptions, because they must explicitly allow the principal. Cross-account is the other exception, where both sides have to allow.",{"question":1574,"type":1532,"options":1575,"correctAnswer":1358,"explanation":1576},"Which AWS STS operation lets you supply MFA information so the resulting credentials are marked as MFA-authenticated?",[1308,1325,1341,1358],"`GetSessionToken` and `AssumeRole` are the 2 operations that accept MFA information, which is what makes the `aws:MultiFactorAuthPresent` condition key true for the resulting session. The federated operations authenticate the user at the identity provider instead, so AWS never sees an MFA challenge, and `GetFederationToken` does not accept MFA input either.",{"question":1578,"type":1532,"options":1579,"correctAnswer":1581,"explanation":1582},"True or False: an IAM administrator can edit the permissions policy attached to a service-linked role.",[1580,1581],"True","False","Service-linked roles are owned by the service that created them, and an administrator can view but not edit their permissions. That ownership is also why you must delete the service's related resources before you can delete the role, which prevents you from stranding resources the service can no longer reach.",{"question":1584,"type":1532,"options":1585,"correctAnswer":1586,"explanation":1590},"A security team wants one policy document reused across 30 roles, with a single edit propagating to all of them. Which policy form fits?",[1586,1587,1588,1589],"A customer managed policy attached to each role","An inline policy copied into each role","A resource-based policy on each role","A permissions boundary on each role","Managed policies are standalone objects that many identities can reference, so one edit reaches every attachment. Inline policies are strictly one-to-one with the identity and are deleted with it, so 30 copies would need 30 edits. A permissions boundary can also be reused, but it caps permissions rather than granting them.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/04-security-and-compliance/01-iam-and-access-management/01-iam-policies-and-roles","rm69Dn_7qjUp5yJgZGVAGEb015d-ZISE-q1q4cv3g24",{"locked":9,"reason":1595,"meta":1596,"item":3},"paywall",{"title":1597,"description":1598,"isFree":5,"estimatedMinutes":1599,"difficulty":11,"learningObjectives":1600},"Event-Driven Operations Automation","Wire routine operational work to run itself: S3 Event Notifications and their delivery guarantees, direct destinations versus EventBridge, EventBridge Scheduler for time-based work, choosing where a schedule lives among four AWS mechanisms, Lambda versus an Automation runbook, and Change Calendar as a guardrail.",24,[1601,1602,1603,1604,1605,1606],"Configure S3 Event Notifications and account for at-least-once delivery, variable latency, and the recursion hazard","Choose between an S3 direct destination and routing S3 events through EventBridge","Select EventBridge Scheduler for time-based automation and explain what it adds over a scheduled rule","Decide where a recurring operational task should be scheduled among EventBridge Scheduler, a maintenance window, a State Manager association, and a scheduled rule","Choose between a Lambda function and a Systems Manager Automation runbook as the action behind an event","Use Change Calendar to block automation during a freeze, and describe the two calendar types",{"locked":9,"reason":1595,"meta":1608,"item":3},{"title":1609,"description":1610,"isFree":5,"estimatedMinutes":1611,"difficulty":1612,"learningObjectives":1613},"Policy Evaluation and Conditions","How AWS turns 6 competing policies into one allow or deny: the enforcement order, which policy types add permissions and which only subtract, permissions boundaries, and the condition operators and global condition keys that decide the close calls.",30,"advanced",[1614,1615,1616,1617,1618,1619],"State the AWS enforcement order and name what happens at each gate","Predict whether a given pair of policy types combines as a union or an intersection","Explain why a permissions boundary can deny a request that an identity-based policy allows","Choose the correct condition operator for a key, including the IfExists and Null forms","Apply the rule that a missing condition key makes an ordinary condition false, and describe where that rule inverts","Select the right global condition key for network, organization, MFA, and tagging restrictions"]