AWS IAM and Security
Two things carry most AWS security questions: what the shared responsibility model puts on your side of the line, and how IAM resolves a request when several policies apply. The evaluation table is the one that decides exam answers.
AWS IAM and Security · firsttry.app/cheatsheets/aws-iam-and-security · original reference written from published exam objectives. Not affiliated with any certification body.
Policy evaluation, in order
| Step | Rule |
|---|---|
| 1 | An explicit Deny anywhere wins. Nothing overrides it |
| 2 | Service control policies must allow it |
| 3 | Resource-based policy Allow is checked |
| 4 | Identity-based policy Allow is checked |
| 5 | Permission boundaries must allow it |
| 6 | No matching Allow means implicit deny |
IAM building blocks
| Object | What it is | When to use |
|---|---|---|
| User | A long-lived identity with credentials | A person. Avoid for workloads |
| Group | A collection of users | Attach policies once, not per user |
| Role | An identity assumed temporarily | Services, cross-account, federated users |
| Instance profile | A role attached to EC2 | Never put keys on an instance |
| Identity-based policy | Attached to a user, group or role | Most permissions |
| Resource-based policy | Attached to a resource | S3 buckets, KMS keys, cross-account |
| Permission boundary | A ceiling on a principal | Delegating admin safely |
| Service control policy | An org-wide ceiling | Guardrails across accounts |
| Root user | The account owner | Lock it, enable MFA, never use daily |
Shared responsibility
| AWS is responsible for | You are responsible for |
|---|---|
| Physical facilities and hardware | Your data and how it is classified |
| The hypervisor and host OS | Guest OS patching on EC2 |
| Managed service infrastructure | IAM users, roles and permissions |
| Network infrastructure | Security groups and network ACLs |
| Encryption capability (KMS) | Choosing to encrypt, and key policy |
| Availability of the service | Architecting your workload for it |
Security services
| Service | What it does |
|---|---|
| IAM Identity Center | Workforce single sign-on across accounts |
| KMS | Managed encryption keys |
| CloudHSM | Dedicated hardware security module |
| Secrets Manager | Secret storage with rotation |
| GuardDuty | Threat detection from logs and DNS |
| Inspector | Vulnerability scanning of workloads |
| Macie | Finds sensitive data in S3 |
| Security Hub | Aggregates findings against standards |
| CloudTrail | Records API calls. The audit log |
| Config | Records resource configuration and drift |
| WAF | Layer 7 filtering |
| Shield | DDoS protection, Standard is automatic |
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.