ExamFinch.com My Study

Study guide

2.2 AWS Identity and Access Management (IAM)

Practice this exam

AWS Certified Cloud Practitioner CLF-C02

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Cloud Practitioner (CLF-C02) Exam Study Strategies and Exam Tips

2 Domain 1: Cloud Concepts (24%)

1.1 What Is Cloud Computing? 1.2 Cloud Deployment Models 1.3 AWS Well-Architected Framework 1.4 Cloud Migration Strategies 1.5 Cloud Economics

3 Domain 2: Security and Compliance (30%)

2.1 The AWS Shared Responsibility Model 2.2 AWS Identity and Access Management (IAM) 2.3 AWS Security Services 2.4 Compliance and Governance 2.5 Network Security

4 Domain 3: Cloud Technology and Services (34%)

3.1 AWS Compute Services 3.2 AWS Storage Services 3.3 AWS Database Services 3.4 AWS Networking and Content Delivery 3.5 Management and Governance Services 3.6 AI/ML and Analytics Services 3.7 Application Integration and Other Services

5 Domain 4: Billing, Pricing, and Support (12%)

4.1 AWS Pricing Models 4.2 Billing and Cost Management Tools 4.3 AWS Support Plans 4.4 Additional Billing Concepts and Services

6 AWS Services Deep Dive

5.1 Compute Services Deep Dive 5.2 Storage and Database Deep Dive 5.3 Security Services Deep Dive 5.4 Architecture Best Practices and Design Principles 5.5 Practice Exam — Mixed Domain Questions

2.2 AWS Identity and Access Management (IAM)

Key Takeaways Explain This Topic AI

IAM is a free, global service (not Region-specific) that controls who can access what in your AWS account.

The root user has unrestricted access; secure it with MFA and use it only for the few tasks that require it.

IAM follows the principle of least privilege — grant only the permissions needed, and an explicit Deny always overrides an Allow.

IAM policies are JSON documents with Effect, Action, Resource, and optional Condition elements.

IAM roles provide temporary credentials and are the recommended way to grant permissions to AWS services and applications.

Last updated: October 2026

Quick Answer: AWS IAM is a free, global service that controls who (authentication) can do what (authorization) in your AWS account. Core components: Users (people), Groups (collections of users), Roles (temporary permissions for services/apps), and Policies (JSON documents defining permissions). Always follow the principle of least privilege .

IAM Overview

AWS Identity and Access Management (IAM) is one of the most important services on the exam. It lets you securely manage access to AWS services and resources.

Key Facts:

  • IAM is free — there is no charge to use it
  • IAM is global — not Region-specific (users, groups, roles, and policies apply across all Regions)
  • IAM supports MFA (Multi-Factor Authentication) for added security
  • IAM gives you centralized control of your account
  • The Root User

When you create an AWS account, you create a root user with the email and password used to sign up. The root user has complete, unrestricted access to everything in the account.

Root User Best Practices

  • Do Don't
  • Enable MFA on the root user immediately Use the root user for everyday tasks
  • Create an IAM admin user for daily work Share root user credentials
  • Store root credentials securely Create access keys for the root user
  • Use root only for root-specific tasks Leave MFA disabled on root
  • Tasks That REQUIRE the Root User

Update the root user email address, root user password, or root user access keys (standalone accounts; the account name, contact information, and Regions no longer need the root user)

  • Close a standalone AWS account (AWS Organizations can close member accounts centrally)
  • Restore IAM user permissions if the only IAM admin is locked out
  • Configure an S3 bucket for MFA delete, or edit an S3 bucket policy that denies all principals
  • Activate IAM access to the Billing and Cost Management console and view certain tax invoices
  • Register as a seller in the Reserved Instance Marketplace
  • IAM Components
  • IAM Users

An IAM user represents a person or service that interacts with AWS. Each user has a unique name, credentials (a console password and/or access keys for the CLI/API), and permissions defined by attached policies. Best practice: create one IAM user per person and never share credentials.

IAM Groups

An IAM group is a collection of users that makes permissions easier to manage.

  • Feature Detail
  • Groups contain users only Groups cannot contain other groups
  • A user can belong to multiple groups No limit on groups per user
  • Groups are not used for authentication Only for organizing permissions
  • No default group Users must be explicitly added

Example groups: Administrators, Developers, Finance, ReadOnlyUsers.

IAM Roles

An IAM role is like a user but is meant to be assumed by whoever or whatever needs it, providing temporary security credentials .

  • Use Case Example
  • EC2 accessing S3 Attach a role to the instance instead of storing keys
  • Cross-account access Let users in Account A access resources in Account B
  • Service to service A Lambda function accessing DynamoDB
  • Federated users External users (SAML/OIDC) accessing AWS via an identity provider

On the Exam: When a question asks how to grant an AWS service (EC2, Lambda) permission to access another service (S3, DynamoDB), the answer is almost always an IAM role — never embedded access keys.

IAM Policies

IAM policies are JSON documents that define permissions — what actions are allowed or denied on which resources.

Policy structure:

Version — policy language version (currently "2012-10-17")

Statement — one or more permission statements, each with:

  • Effect — "Allow" or "Deny"
  • Action — the API action(s), e.g., s3:GetObject
  • Resource — the resource(s) by ARN
  • Condition (optional) — when the policy applies

Policy types: AWS managed (pre-built by AWS, e.g., AmazonS3ReadOnlyAccess), customer managed (you create and maintain), and inline (embedded in a single user/group/role, not reusable). An explicit Deny always overrides an Allow .

The Principle of Least Privilege

Least privilege means granting only the minimum permissions needed to perform a task — nothing more. Example: a developer who only needs to read one S3 bucket should have a policy allowing s3:GetObject on that specific bucket, NOT s3:* on all buckets.

Multi-Factor Authentication (MFA)

MFA adds a layer of security by requiring two factors: something you know (password) and something you have (an MFA device).

  • MFA Type Description
  • Virtual MFA device App on your phone (Google Authenticator, Authy)
  • Hardware TOTP token Physical key fob that generates codes
  • FIDO2 security key Physical USB/NFC key (e.g., YubiKey)

On the Exam: Always enable MFA on the root account, and treat MFA as a best practice for all IAM users with console access — especially administrators.

  • IAM Best Practices Summary
  • Lock away the root user — enable MFA, do not use for daily tasks
  • Create individual IAM users — one per person, never shared
  • Use groups to assign permissions — easier than per-user policies
  • Use roles for AWS services — never embed access keys in code
  • Grant least privilege — start minimal, add only as needed
  • Enable MFA everywhere — especially for privileged accounts
  • Rotate credentials regularly
  • Use IAM Access Analyzer — find resources shared with external entities
  • Use AWS Organizations — manage multiple accounts with service control policies