SCS-C03 Domain 4: Identity and Access Management (20%)
IAM is the heaviest domain of the SCS-C03 exam: 20%. It splits into authentication (who you are and how you get temporary credentials) and authorization (what you can do, with least privilege, and how to debug an access denied).
Weight on the exam: 20%. It is one of the six domains of the AWS Certified Security – Specialty SCS-C03 exam. Below is a summary of its tasks and skills according to the official AWS guide.
Tasks and skills tested
Task 4.1: Design, implement, and troubleshoot authentication strategies
- Design and establish identity solutions for human, application, and system authentication (for example, AWS IAM Identity Center, Amazon Cognito, multi-factor authentication [MFA], identity provider [IdP] integration).
- Configure mechanisms to issue temporary credentials (for example, AWS STS, Amazon S3 presigned URLs).
- Troubleshooting authentication issues (for example, CloudTrail, Amazon Cognito, IAM Identity Center permission sets, AWS Directory Service).
Task 4.2: Design, implement, and troubleshoot authorization strategies
- Design and evaluate authorization controls for human, application, and system access (for example, Amazon Verified Permissions, IAM paths, IAM Roles Anywhere, resource policies for cross-account access, IAM role trust policies).
- Design attribute-based access control (ABAC) and role-based access control (RBAC) strategies (for example, by configuring resource access based on tags or attributes).
- Design, interpret, and implement IAM policies by following the principle of least privilege (for example, permission boundaries, session policies).
- Analyze authorization failures to determine causes or effects (for example, IAM Policy Simulator, IAM Access Analyzer).
- Investigate and correct unintended permissions, authorizations, or privileges granted to a resource, service, or entity (for example, IAM Access Analyzer).
Services and tools to master
- AWS IAM
- IAM Identity Center
- Amazon Cognito
- AWS STS
- IAM Roles Anywhere
- Amazon Verified Permissions
- IAM Access Analyzer
- IAM Policy Simulator
- AWS Directory Service
Key facts for domain 4
Short summaries; each links to the study topic with the full note and its official source.
- Explicit deny — An explicit Deny always overrides any Allow.
- Permissions boundary — A permissions boundary never grants permissions: effective permissions are the INTERSECTION of the identity-based policy and the boundary.
- Three layers must all allow — In a member account with no resource-based policy, an action must be allowed by the identity-based policy, the SCPs and the RCPs at the same time.
- Role trust and External ID — The ExternalId in a role's trust policy prevents the confused deputy problem with third parties.
- Cross-service confused deputy — When you grant access to a service principal (e.g. cloudtrail.amazonaws.com), use aws:SourceArn or aws:SourceAccount in the resource policy.
- RCPs against confused deputy — A resource control policy (RCP) can enforce confused deputy controls centrally with aws:SourceOrgID and aws:SourceOrgPaths, without editing every resource policy.
- Presigned URLs = the creator's permissions — A presigned URL uses the credentials and permissions of whoever generated it and works as a bearer token.
- Presigned URL lifetime — A presigned URL lasts from 1 minute to 12 hours from the console, and up to 7 days with the CLI/SDK using IAM user credentials and SigV4.
- What Access Analyzer analyzes — IAM Access Analyzer offers external access, internal access and unused access analyzers, plus policy validation, custom policy checks and policy generation from CloudTrail.
- External access: per Region — External access analysis only covers resources in the same Region where it is enabled: create one analyzer per Region in use.
- Unused access — The unused access analyzer detects unused roles, unused access keys and passwords of IAM users, and unused services and actions in active roles.
- Generate a least-privilege policy — Access Analyzer generates an IAM policy from the actual activity of a user or role in CloudTrail over the date range you choose.
Practice Domain 4
Answer practice questions, read the explanation and review your mistakes with spaced repetition.