IAM and access management

5-minute essentials

1. By default every request is denied (implicit deny); you need at least one matching Allow, and an explicit Deny in any policy beats every Allow.Reading a permissions question: look for Deny first, then SCP, then resource / identity policy, permissions boundary, session policy.
2. User = long-term identity (password, access key); role = an identity you "borrow" with temporary credentials from STS.AWS recommends roles and federation over long-term access keys; applications on EC2 / Lambda / ECS always use roles.
3. EC2 gets permissions through an instance profile (a role attached to the instance); the SDK fetches temporary credentials from instance metadata automatically.The answer "store access keys in a config file on EC2" is always wrong.
4. A role has a trust policy (who can assume it) and a permission policy (what it can do once assumed).To let account B into account A: create a role in A that trusts B; the person in B needs sts:AssumeRole permission on that role. For third parties, add an External ID.
5. Resource-based policies (bucket policy, key policy, queue policy, etc.) have a Principal element and allow cross-account access without assuming a role.Cross-account with a resource policy: the caller keeps its own permissions; with a role: the caller switches to the role's permissions.
6. An Organizations SCP sets a permission ceiling for users / roles in member accounts and grants nothing; it does not apply to the management account or service-linked roles."Prevent every account from turning off CloudTrail / using Regions outside an allowed list" → an SCP with Deny attached to an OU or the root.
7. A permissions boundary sets a ceiling for one specific user / role; effective permissions = the intersection of the identity policy and the boundary.Let developers create roles themselves without escalating privileges: require new roles to have the boundary attached.
8. IAM Identity Center: single sign-on to multiple accounts in Organizations, permissions assigned through permission sets, can connect to an external IdP (Entra ID, Okta, etc.).Employees use their company account to reach many AWS accounts: Identity Center is the modern answer, instead of creating IAM users in each account.
9. A Cognito user pool is a user directory (sign-up, sign-in, MFA, social login); an identity pool exchanges that identity for temporary AWS credentials.A mobile / web app whose customers access S3 or DynamoDB directly: Cognito, not IAM users.
10. Protect the root user: enable MFA, create no access keys, and use it only for the few tasks that require it.Daily work uses users / roles with least privilege; root is only for tasks like changing the support plan or closing the account.
11. A role's temporary credentials last 1–12 hours depending on configuration; role chaining (assuming another role from a role) is limited to 1 hour.A session cut off after 1 hour even though 12 hours was set: usually caused by role chaining.
12. IAM Access Analyzer finds resources shared outside the zone of trust (account / organization) and validates policies before you apply them."Find buckets, keys and roles that allow outside access" → Access Analyzer.
13. Policy Conditions: aws:SourceIp, aws:MultiFactorAuthPresent, aws:RequestedRegion, aws:PrincipalOrgID, tags (ABAC), etc.Tag-based permissions (ABAC) need fewer policies as projects grow; aws:PrincipalOrgID shares with a whole organization without listing each account.

Diagrams

Quick comparisons

Policy types

Cross-account access

Identity by audience

Organizations and Control Tower

Exam scenarios

Quick picks

What do you use to grant / limit permissions?

Common pitfalls

• Storing access keys on EC2 or in code instead of using a role.
• Thinking an SCP grants permissions: an SCP only sets a ceiling; you still need an identity policy.
• Thinking an SCP can restrict the management account: it does not apply to the management account.
• Forgetting that an explicit Deny beats every Allow, even AdministratorAccess.
• Letting a third party assume a role without an External ID.
• Using root for daily work, or creating access keys for root.
• Using IAM users for an application's customers (that is Cognito's job).
• Mixing up a user pool (sign-in) with an identity pool (exchange for AWS credentials).
• Listing each account in a bucket policy instead of using aws:PrincipalOrgID.
• Thinking a permissions boundary grants extra permissions.
• Forgetting that role chaining limits the session to 1 hour.

Services in this module

• IAMwho can do what
• STStemporary credentials
• IAM Identity Centersingle sign-on (SSO)
• Organizationsmanage multiple accounts
• Control Towermulti-account landing zone setup
• Access AnalyzerIAM access analysis
• Cognitosign-in for app users
• Directory Servicemanaged Active Directory
• Resource Access Managershare resources across accounts

Numbers that change (checked against AWS docs)

• Defaults: 20 managed policies per role (max 25), 10 per user (max 20), 10 per group; 1,000 roles per account (max 10,000). checked 2026-10-16 ↗
• A managed policy is at most 6,144 characters; total inline policy size: user 2,048, group 5,120, role 10,240 characters (excluding whitespace). checked 2026-10-16 ↗
• A role session ranges from 15 minutes up to 12 hours depending on max session duration; the default is 1 hour if unspecified. checked 2026-10-16 ↗
• Role chaining limits the session to a maximum of 1 hour, regardless of the role's max session duration. checked 2026-10-16 ↗
• Evaluation order: explicit Deny → RCP → SCP → resource-based → identity-based → permissions boundary → session policy; an explicit Deny beats every Allow. checked 2026-10-16 ↗
• SCPs grant no permissions, do not apply to users / roles of the management account or to service-linked roles; they do apply to the root user of member accounts. checked 2026-10-16 ↗
• An SCP is at most 10,240 characters; at most 10 SCPs attached directly to the root, each OU and each account; OUs nest up to 5 levels. checked 2026-10-16 ↗
• Organizations allows at most 10 accounts by default (can be raised via Service Quotas). checked 2026-10-16 ↗
• ABAC: one policy allows an action when the principal's tag matches the resource's tag; adding new resources needs no policy change. checked 2026-10-19 ↗
• RDS IAM database authentication: a token signed with Signature V4 that lasts 15 minutes, for MariaDB, MySQL, PostgreSQL; the connection is encrypted with SSL/TLS. checked 2026-10-19 ↗