1 · IAM Deep Dive — Revise¶

Security · 30% · Compressed recall. Read the Learn guide first.

Key facts¶

Fact	Value
IAM scope	Global (not per-Region), no charge
Consistency	Eventually consistent
Root user	Unrestricted; can't be limited by IAM policy (only SCP can, in an Org)
Group	Container only — no credentials, can't be a `Principal`, can't nest
User can be in	Multiple groups
Role	Identity with no permanent creds; assumed → temporary STS creds
Role's two policies	Trust policy (who can assume) + permission policy (what it can do)
Temp creds include	access key + secret + session token
Assumed-role session	15 min – 12 h; default 1 h
`Version` value	Always `2012-10-17` (language version, not a date)
`Principal` field	Only in resource-based / trust policies

Policy types & effect¶

Type	Attached to	Role
Identity-based (managed / inline)	user, group, role	Grants
Resource-based	S3/SQS/SNS/KMS/Lambda/role-trust…	Grants (can be cross-account)
Permissions boundary	user, role	Caps (max ceiling)
SCP (Organizations)	OU / account	Caps account (incl. root)
Session policy	passed at AssumeRole	Caps the session

Verified quotas (default → max)¶

Quota	Default	Max
Managed policies / user	10	20
Managed policies / role	10	25
Managed policies / group	10	10
Customer managed policies / account	1,500	10,000
Groups / account	300	500
Roles / account	1,000	10,000
Managed policy size	6,144 chars	—

Evaluation logic (memorize)¶

Implicit DENY (default)
    │
    ├─►  Any explicit DENY matching?  ── yes ──►  DENIED  (never overridable)
    │        │ no
    ├─►  Allowed by identity OR resource policy?
    │        │ yes
    ├─►  Within permissions boundary (if any)?   ── no ──►  DENIED
    │        │ yes
    ├─►  Allowed by SCP (if in Org)?             ── no ──►  DENIED
    │        │ yes
    └─►  ALLOWED

Explicit Deny > Explicit Allow > Implicit Deny.

Combination rules¶

Combo (same account)	Rule
Identity + Identity	Union
Identity + Resource	Union (either allows)
Identity + Boundary	Intersection (both must allow)
Identity + SCP (+RCP)	Intersection (all must allow)
Cross-account	Need both target resource policy and caller identity policy

Decision tree — "what do I attach?"¶

Workload on EC2/Lambda/ECS needs AWS access?
   └─► IAM ROLE (EC2 → instance profile; Lambda → execution role; ECS → task role)

Human needs access to many accounts?
   └─► IAM Identity Center (SSO) + permission sets

Corporate IdP (AD/Okta)?           └─► SAML 2.0 federation → assume role
App/mobile users (Google/FB)?      └─► Cognito / OIDC web identity → temp creds
Third-party SaaS assumes a role?   └─► Trust policy + sts:ExternalId (confused deputy)
Own accounts in one Org?           └─► Condition aws:PrincipalOrgID
Let teams make roles within a cap? └─► Permissions boundary
Org-wide guardrail?                └─► SCP

Flashcards¶

An AdministratorAccess user also has an inline Deny s3:*. Can they use S3?

No — explicit deny overrides any allow.

Does a permissions boundary grant permissions?

No. It only caps. Effective = intersection(identity policy, boundary). It can never add access the identity policy doesn't already grant.

Same account: identity policy is silent on S3, but the bucket policy allows the user. Access?

Yes — identity + resource policies are a union in-account; either allow suffices (absent a deny).

Cross-account: what must be true for access?

Both sides agree — the target's resource policy (or an assumable role's trust policy) allows the caller, AND the caller's identity policy allows the action.

How does app code on EC2 get AWS credentials?

An IAM role via an instance profile → temporary auto-rotating creds. Never store long-term keys on the instance / in user data / in the AMI.

How do you restrict what the root user of a member account can do?

An SCP in AWS Organizations. IAM policies can't restrict same-account root.

What stops the confused-deputy problem with a third-party role?

Require a shared secret sts:ExternalId in the role's trust policy condition.

Which condition key allows any account in your Organization without listing IDs?

aws:PrincipalOrgID.

How do you actually force HTTPS on an S3 bucket?

Explicit Deny when aws:SecureTransport is false. A conditional allow alone doesn't block plain HTTP.

Which tool shows services a principal has/hasn't used (to trim permissions)?

IAM Access Advisor (last-accessed data). Account-wide CSV of keys/MFA = credential report. External-sharing findings = IAM Access Analyzer.

ABAC vs RBAC — which scales without new policies per team?

ABAC — compare tags (e.g. aws:PrincipalTag/Project = aws:ResourceTag/Project). Onboarding = a tag, not a new policy.

How do you require MFA for a sensitive action?

Condition on aws:MultiFactorAuthPresent = true (use BoolIfExists to avoid locking out contexts where the key is absent).

Common traps¶

Explicit Deny beats everything — including AdministratorAccess.
Boundary/SCP never grant — they only cap; you still need an allow.
Groups aren't principals and can't be assumed or nested.
NotAction / NotPrincipal invert the match — read carefully.
Conditional allow ≠ deny — to block, use an explicit Deny.
Cross-account = both sides; same account = union (either).
Version is a language version, not a date to bump.
No long-term keys on EC2 / in mobile apps → roles / Cognito.
Enforce IMDSv2 to stop SSRF-based credential theft from instance metadata.