Designing and Reviewing Access

Designing access you can defend, then proving it is not too wide: ABAC with principal and resource tags against RBAC with permission sets, evidence-driven least privilege from last-accessed data and generated policies, application authorization with Amazon Verified Permissions and Cedar, and finding and fixing over-permission with IAM Access Analyzer.

Content current as of 2026-10.

Lessons

1. ABAC and RBAC
2. Engineering least privilege
3. Application authorization with Verified Permissions
4. Finding and fixing over-permission

Sources

• SCS-C03 exam guide — Content Domain 4 (tasks 4.1–4.2)
• IAM User Guide — controlling access to AWS resources using tags
• IAM Access Analyzer — findings
• IAM User Guide — testing policies with the IAM policy simulator
• Amazon Verified Permissions user guide