Key points

• IAM defines principals, roles, policies, groups, and authorization for AWS API actions.
• Role trust and identity or resource policy permissions must align, while network and data-engine permissions remain separate.

Best-known use cases

• Grant data jobs least-privilege access through service roles.
• Delegate cross-account dataset access without sharing long-term credentials.

What candidates often confuse it with

• IAM authorizes AWS actions; Lake Formation and database grants can impose additional data-level controls.

Key takeaway

Use IAM to give each data workload temporary, least-privilege access at the narrowest durable scope.

Relevant exam tasks

• D4.1 — Task 4.1: Apply authentication mechanisms
• 4.1.2 — Create and update IAM groups, roles, endpoints, and services.
• 4.1.4 — Set up IAM roles for access (for example, AWS Lambda, Amazon API Gateway, AWS CLI, AWS CloudFormation).
• 4.1.5 — Apply IAM policies to roles, endpoints, and services (for example, S3 Access Points, AWS PrivateLink).
• D4.2 — Task 4.2: Apply authorization mechanisms
• 4.2.1 — Create custom IAM policies when a managed policy does not meet the needs.
• 4.2.5 — Apply authorization methods that address business needs (role-based, tag-based, and attribute-based).
• 4.2.6 — Construct custom policies that meet the principle of least privilege.

Learn more

• DEA-C01 in-scope services
• DEA-C01 Domain 4: Data Security and Governance