Unit 4: Identity and Access Management (IAM)

This curriculum overview outlines the core competencies required to master Identity and Access Management (IAM) within the context of the AWS Certified Security - Specialty (SCS-C03) exam. IAM is the foundational security layer of AWS, governing how every entity—human or machine—interacts with cloud resources.

Curriculum Visual Map

---

Prerequisites

Before beginning this unit, learners should have a solid grasp of the following concepts and tools:

• Cloud Fundamentals: Understanding of the Shared Responsibility Model (specifically the customer's responsibility for data and identity).
• Basic AWS Architecture: Familiarity with AWS Regions, Availability Zones, and core services (EC2, S3).
• Technical Environment:
  • Active AWS Account for hands-on practice.
  • AWS CLI installed and configured.
  • A mobile device for testing Multi-Factor Authentication (MFA) applications (e.g., Google Authenticator).
• Foundational Knowledge: Completion of Units 1-3 (Detection, Incident Response, and Infrastructure Security) is recommended to understand the context in which IAM operates.

---

Module Breakdown

---

Learning Objectives per Module

4.1: Authentication Strategies

• Design and Establish Identity Solutions: Configure AWS IAM Identity Center (formerly AWS SSO) for workforce identities and Amazon Cognito for customer-facing application identities.
• Temporary Credentials: Implement AWS Security Token Service (STS) to issue short-lived credentials, reducing the risk of long-term credential exposure.
• Multi-Factor Authentication: Design MFA enforcement policies for both root users and standard IAM users.

4.2: Authorization Strategies

• Advanced Policy Design: Interpret and implement complex policy types, including Permission Boundaries, Session Policies, and Resource-based Policies.
• ABAC vs. RBAC:
  • RBAC (Role-Based Access Control): Assigning permissions based on job function.
  • ABAC (Attribute-Based Access Control): Using tags (e.g., Project: Omega) to grant dynamic access.
• Principle of Least Privilege: Crafting JSON policies that provide only the specific permissions needed for a task.

4.3: Analysis & Troubleshooting

• Authorization Failure Analysis: Use the IAM Policy Simulator to diagnose "Access Denied" errors and identify which policy (SCP, Identity-based, or Resource-based) is causing the block.
• Unintended Access Detection: Utilize IAM Access Analyzer to find resources shared outside the AWS account or organization.

[!IMPORTANT] Policy Evaluation Logic Always remember: An Explicit Deny in any applicable policy always overrides an Explicit Allow.

---

Success Metrics

To demonstrate mastery of Unit 4, learners should be able to successfully complete the following tasks:

1. JSON Policy Drafting: Write a policy that allows an EC2 instance to read from a specific S3 bucket only if the request originates from a specific VPC endpoint.
2. Troubleshooting Proficiency: Identify why a user cannot access a resource despite having an AdministratorAccess identity policy (e.g., due to an SCP or a Permission Boundary).
3. Credential Security: Successfully configure AWS Secrets Manager to automatically rotate database credentials without application downtime.
4. Audit Readiness: Generate an IAM Credential Report and identify accounts with unused access keys older than 90 days.

---

Real-World Application

In a professional setting, the skills gained in this unit translate directly to high-impact security roles:

• Cloud Security Engineer: Designing cross-account access for third-party auditing tools using IAM Role Trust Policies.
• Compliance Officer: Using IAM Access Analyzer to provide evidence for SOC2 or PCI-DSS audits, proving that public access to data is restricted.
• Solutions Architect: Implementing a Zero-Trust architecture where every service-to-service communication is authenticated via IAM Roles and authorized via temporary STS tokens.

Policy Evaluation Logic Diagram

[!TIP] When studying, focus heavily on the interaction between SCPs (Service Control Policies) and IAM Policies. SCPs set the maximum permissions for an account, but do not grant permissions by themselves.