Security
AWS IAM
Manages identities, roles, permissions, and least-privilege access.
Key points
- Controls access to AWS services and resources through users, groups, roles, and policies.
- Supports least privilege by granting only the actions and resources required.
- Roles provide temporary credentials and are preferred for AWS services and federated workloads.
- Policy evaluation combines identity policies, resource policies, permission boundaries, and organization controls where used.
- Is central to securing AI services, data sources, model endpoints, logs, and automation.
When to use it
- Choose IAM when the question asks who can access an AWS AI service or resource.
- Use roles for applications, Lambda functions, SageMaker jobs, Bedrock integrations, and cross-account access.
- Use least-privilege policies to limit access to datasets, models, prompts, and administrative actions.
Exam tips
- IAM authorizes access; CloudTrail records API activity after requests are made.
- Do not use long-term user access keys when a role or federation pattern fits better.
- Least privilege is a recurring AIF-C01 security and governance principle.
- IAM does not encrypt data; KMS manages encryption keys.