IAM roles, policies and SCPs
Almost every SAA-C03 scenario has a security angle, and most of it comes down to who can do what. If you understand how the policy types stack, you can answer these questions quickly.
Users, groups and roles
Use IAM roles for workloads and for people who sign in through federation (IAM Identity Center, formerly AWS SSO). A role gives temporary credentials from AWS STS. Avoid long-term access keys; they are the usual wrong answer.
- EC2 gets a role through an instance profile.
- Lambda uses an execution role.
- ECS tasks use a task role.
- The root user is only for the few tasks that need it. Enable MFA, create no access keys, and use IAM Identity Center or IAM users for daily work.
Policy types
| Policy | Attached to | Purpose |
|---|---|---|
| Identity-based | User, group, role | Grants permissions |
| Resource-based | S3 bucket, SQS queue, KMS key, role trust | Grants access to a named principal, also across accounts |
| Permissions boundary | User or role | Sets the maximum an identity can get |
| SCP | Organization root, OU or account | Sets the maximum for all principals in the account |
| Session policy | STS session | Narrows one temporary session |
Remember the rule: an explicit Deny always wins, and without an explicit Allow the answer is deny. A boundary or SCP never grants anything; the identity still needs its own Allow, and the Allow must fall inside every limit.
Service control policies
SCPs are part of AWS Organizations. They apply to member accounts, including their root users, but not to the management account. Typical uses are blocking Regions that are not approved, stopping changes to CloudTrail or AWS Config, and preventing accounts from leaving the organization. Use them when the question says “no one in the account, even administrators”.
Cross-account access
The cleaner pattern is for the second account to create a role that trusts the first account, and users call sts:AssumeRole. A resource policy alone can also work for services that support it, such as S3 bucket policies. Without a resource policy, the caller must assume a role in the target account.
Finding too much access
IAM Access Analyzer finds resources shared outside your account or organization and can generate a least-privilege policy from CloudTrail activity. The IAM credential report lists users with the age of their keys and their MFA status.
Exam traps
- An SCP does not grant permissions. It only filters what is allowed.
- SCPs do not affect the management account, and they do not affect service-linked roles.
- A role’s trust policy says who can assume it; its permissions policy says what it can do. Both are needed.
- Access keys inside an instance or an AMI are almost always wrong when a role is possible.
- A permissions boundary limits one identity; an SCP limits a whole account.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. An application on an EC2 instance must read objects from one S3 bucket. What is the most secure way to give it access?
Show answer
Answer: B.An IAM role gives the instance temporary credentials that rotate automatically, so no long-term keys are stored.
2. A security team must make sure that nobody in any member account, even an administrator, can disable AWS CloudTrail. What should they use?
Show answer
Answer: B.An SCP sets the maximum permissions for accounts in an organization and also limits the account administrators. It never grants access by itself.
3. A developer must be able to create IAM roles but only roles that stay within a defined set of permissions. Which feature helps?
Show answer
Answer: A.A permissions boundary caps the permissions an IAM user or role can have, even if its identity policies allow more.
4. A user in account A must read a bucket in account B. The bucket policy in B allows the user. What is also required?
Show answer
Answer: B.For cross-account access both sides must allow it, the resource policy in B and an identity policy in A.