Identity & Access Management

Authentication, temporary credentials, and policy evaluation — the heaviest at 20%

• Authentication Strategies — Establishing who the caller is: IAM Identity Center and permission sets as the answer for human access at scale, SAML 2.0 and OIDC federation mechanics, Cognito user pools versus identity pools, the Directory Service options, MFA enforcement that actually fails closed, root user credential management — and a diagnostic method for when sign-in breaks. (4 lessons, 60 min)
• Temporary Credentials — Short-lived credentials end to end: the five AWS STS operations and when each applies, the two-policy role model, session duration and the one-hour role-chaining cap, cross-account trust and the confused-deputy defences, IAM Roles Anywhere for workloads off AWS, S3 presigned URLs, and the narrowing-only power of session policies and session tags. (4 lessons, 55 min)
• Policy Evaluation — The chain that decides every single request: an explicit deny anywhere wins, and then every applicable layer — organization policies, resource policy, permissions boundary, session policy, identity policy — must allow it. Reading policy documents precisely, the condition keys the exam leans on, cross-account authorization service by service, and the four capping policy types compared. (5 lessons, 75 min)
• Designing and Reviewing Access — Designing access you can defend, then proving it is not too wide: ABAC with principal and resource tags against RBAC with permission sets, evidence-driven least privilege from last-accessed data and generated policies, application authorization with Amazon Verified Permissions and Cedar, and finding and fixing over-permission with IAM Access Analyzer. (4 lessons, 60 min)