🔐
IAM & Security
SecurityIdentity, access management, and encryption fundamentals for the exam.
IAM basics
- ▸Users: long-term credentials for people/apps. Roles: temporary credentials assumed via STS — preferred for AWS resources.
- ▸Policies: JSON documents defining Effect/Action/Resource/Condition; identity-based (attached to principal) or resource-based (attached to resource, can be cross-account).
- ▸Explicit Deny always wins over any Allow.
- ▸Least privilege: grant only the specific actions and resources actually needed.
STS
- ▸AssumeRole: get temporary credentials for a role, commonly for cross-account access.
- ▸AssumeRoleWithWebIdentity / AssumeRoleWithSAML: federate external identity providers into temporary AWS credentials.
KMS & encryption
- ▸Envelope encryption: a data key encrypts the data; a CMK encrypts the data key.
- ▸Customer-managed CMKs support optional automatic annual rotation; AWS-managed keys rotate automatically every year.
- ▸SSE-S3 (AWS-owned key) vs SSE-KMS (customer CMK, CloudTrail audit trail, request quotas apply) vs SSE-C (customer-supplied key, not stored by AWS).
Secrets & config
- ▸Secrets Manager: automatic rotation, native RDS/Redshift/DocumentDB integration, cost per secret.
- ▸SSM Parameter Store: free tier, SecureString via KMS, good for config + simple secrets.
- ▸Cognito: user pools for auth (JWTs), identity pools for temporary AWS credentials via STS.