Security and Compliance
IAM, Multi-Account Guardrails, Access Audit, and Continuous Compliance
CoreApply authentication and authorization at the right identity and account boundary, diagnose effective permissions, and combine guardrails, audit history, advisory checks, and continuous configuration evaluation.
Aligned to AWS Certified CloudOps Engineer - Associate (SOA-C03) Version 1.1, verified August 24, 2026.
Why this matters
An IAM allow is only one input to authorization. Trust, resource policies, boundaries, sessions, SCPs, explicit denies, and request context can change the effective result.
Must Know
- Use the configured workforce identity source and MFA controls for human access; prefer federation and temporary roles over daily IAM users and long-lived keys.
- Identity policies grant to identities, resource policies grant through resources, role trust policies control assumption, permissions boundaries cap identity permissions, and SCPs cap member-account permissions. An applicable explicit deny wins.
- CloudTrail shows past API request context; IAM policy simulation evaluates candidate policy behavior for supported inputs; IAM Access Analyzer identifies external or unused access findings and policy issues.
- SCPs do not grant permissions. Attach a guardrail at the correct root, OU, or account and preserve the required IAM permissions underneath its maximum-permission boundary.
- IAM Identity Center maps workforce users or groups through permission sets to accounts; workload identities still use workload roles.
- AWS Config rules and conformance packs continuously evaluate declared resource configuration. CloudTrail records activity, and Trusted Advisor supplies checks; neither alone continuously evaluates every declared configuration.
Compare and Distinguish
- Authentication proves the principal; authorization evaluates the requested action, resource, and context.
- CloudTrail answers what API call occurred; the policy simulator predicts a supported policy result; Access Analyzer surfaces access findings.
- An SCP limits member-account principals; an IAM policy grants within that limit; Config evaluates resource configuration.
- IAM Identity Center assigns workforce access across accounts; IAM roles provide temporary sessions for people or workloads.
Scenario examples
- Scenario: A role has an identity allow but receives AccessDenied. Inspect CloudTrail context, trust/resource/session/boundary/SCP layers, and explicit denies before adding permissions.
- Scenario: An Organization must prevent one Region while retaining delegated administration elsewhere. Apply and test a scoped SCP deny and retain the underlying role permissions.
- Scenario: Accounts need the same compliance checks. Deploy a conformance pack at the intended scope, aggregate results, and remediate governed findings.
Exam traps
- Do not use an SCP as a permission grant.
- Do not assume one identity-policy allow overrides a permissions boundary or explicit deny.
- Do not use Config as a preventive API authorization control.
- Do not replace investigation with permanent AdministratorAccess.
Key takeaways
- Evaluate effective permissions across all applicable policy types.
- Use temporary human and workload roles at the correct boundary.
- Separate prevention, activity history, findings, and continuous configuration evaluation.
- Remediate narrowly and re-evaluate.
How it works
- Reconstruct the failed request with its principal, action, resource, Region, and condition context.
- Evaluate every applicable allow, explicit deny, trust relationship, and maximum-permission boundary.
- Apply the narrow correction and repeat the request or configuration evaluation to prove the intended result.
When to use it
- Diagnose authentication when the principal cannot prove identity; diagnose authorization when an authenticated principal's requested action, resource, or context is denied.
- Use CloudTrail to reconstruct an API call that occurred, the IAM policy simulator to predict supported policy evaluation, and IAM Access Analyzer to investigate access findings.
- Apply an SCP to cap permissions for member-account principals, an IAM policy to grant within that ceiling, and AWS Config to evaluate resource configuration.
- Assign workforce access across accounts with IAM Identity Center; issue temporary IAM role sessions for people or workloads that need AWS permissions.
Security and governance implications
- Require appropriate MFA and temporary sessions for human administration instead of routine long-lived credentials.
- Protect CloudTrail, Config, and access-analysis evidence from alteration because it supports authorization and compliance investigations.
Failure signals and diagnosis
- Start with the exact principal, action, resource, Region, and request context.
- Look for explicit denies and maximum-permission boundaries before adding an allow.
- For compliance gaps, confirm recorder scope, rule or pack applicability, aggregation, permissions, and remediation output.
More detail
- Combine identity, resource, trust, session, boundary, and SCP evaluation before adding permissions.
- Use federation and temporary roles for people and workloads, with IAM Identity Center handling multi-account workforce assignments.
- Keep preventive authorization, API history, access findings, advisory checks, and AWS Config evaluation conceptually separate.
Ready for the quiz?
- A federated user completes MFA but cannot assume a role. Which evidence distinguishes an authentication problem from a trust-policy or effective-permission denial?
- When should an operator use CloudTrail, policy simulation, or IAM Access Analyzer to investigate access?
- How would you identify whether AccessDenied came from a resource policy, role trust, permissions boundary, session policy, or SCP?
Related objectives
- D4.1 — Task 4.1: Implement and manage security and compliance tools and policies.
- 4.1.1 — Implement IAM features (for example, password policies, multi-factor authentication [MFA], roles, federated identity, resource policies, policy conditions).
- 4.1.2 — Troubleshoot and audit access issues by using AWS tools (for example, CloudTrail, IAM Access Analyzer, IAM policy simulator).
- 4.1.3 — Implement multi-account strategies securely (for example, AWS Organizations, service control policies, IAM Identity Center).
- 4.1.4 — Implement remediation based on the results of AWS Trusted Advisor security checks.
- 4.1.5 — Enforce compliance requirements and continuous monitoring (for example, Region and service selections, AWS Config conformance packs).