CLF-C02
Deep Dive
AWS Identity and Access Management (IAM) is AWS's central security service. It controls who can authenticate and what actions they can perform. It's global, free, and critical for the CLF-C02 exam.
Contents
AWS IAM lets you manage access to AWS services and resources securely. With IAM, you can create and manage AWS users and groups, and use permissions to allow or deny their access to resources.
Free
Cost
No additional cost
Global
Scope
Not region-scoped
Identity
Type
AuthN + AuthZ
Deny all
Default
No permission = denied
IAM Users
An identity within your AWS account that represents a person or service that interacts with AWS. It has permanent credentials (a password for the console, Access Keys for CLI/API).
When to use
When NOT to use / Watch out
IAM Groups
A collection of IAM users. You can specify permissions for a group, which makes it easier to manage permissions for multiple users. Groups CANNOT contain other groups.
When to use
When NOT to use / Watch out
IAM Roles
An identity with specific permissions. Unlike a user, a role has no permanent credentials — its credentials are temporary and are generated automatically when someone assumes the role.
When to use
When NOT to use / Watch out
IAM Policies
JSON documents that define permissions. A policy specifies which actions are allowed or denied on which resources and under what conditions. They're attached to users, groups, or roles.
When to use
Structure of an IAM policy (JSON)
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow", // Allow or Deny
"Action": "s3:GetObject", // Which action
"Resource": "arn:aws:s3:::my-bucket/*", // On which resource
"Condition": { // Optional: conditions
"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}
}
}
]
}⚠️ Don't use root for day-to-day operations
The root account has unlimited access to everything in your AWS account. Compromising root is catastrophic — it has no permission limits.
Never use root for:
✓ When root IS required
There are tasks that ONLY the root account can perform. The exam tests these specifically:
Critical best practice for the exam
After creating an AWS account: (1) enable MFA on root, (2) create an IAM user with admin permissions, (3) use that user for everything. The root account is used only for the specific tasks listed above.
Multi-Factor Authentication (MFA)
MFA adds a layer of security beyond the password. With MFA, users must provide two authentication factors: something they know (password) + something they have (an MFA token).
Virtual MFA
A smartphone app (Google Authenticator, Authy). Generates a 6-digit TOTP code. The most common option on the exam.
E.g.: Google Authenticator, Microsoft Authenticator
Hardware MFA
A physical hardware device that generates codes. More secure than virtual MFA but more expensive.
E.g.: Gemalto, YubiKey
U2F Security Key
A USB security key that connects physically. Authenticates with a physical touch.
E.g.: YubiKey, Google Titan
Assign a virtual MFA device to an admin user and understand why it's critical for privileged accounts.
+1 more...
Principle of Least Privilege: grant only the permissions required to perform the specific task, nothing more. If a user only needs to read files from S3, don't give them administrator permissions.
❌ Bad approach
✓ Good approach
| Dimension | Access Keys (avoid) | IAM Roles (recommended) |
|---|---|---|
| Type | Permanent credentials (Key ID + Secret) | Temporary credentials (STS tokens) |
| Duration | Permanent until rotated/deleted | Expire automatically (15min–12h) |
| If compromised | Compromise persists until rotated | Expires on its own, minimal impact |
| Rotation | Manual — many teams forget | Automatic — AWS STS handles it |
| Storage | Risk of ending up in code, S3, logs | No credentials to store |
| Auditing | Hard to tell which process used which key | CloudTrail shows the role that performed the action |
| Ideal use case | Local development (when there's no alternative) | EC2, Lambda, ECS, EKS — any AWS service |
Golden rule for the exam
If the scenario says "an application on EC2 needs to access S3" → the correct answer is always to create an IAM Role and attach it to the EC2 instance. Never hardcode Access Keys in code or environment variables.
Identity federation lets users from external identity systems (a corporate Active Directory, Google, Facebook) access AWS without creating individual IAM users.
SAML 2.0
Integration with a corporate Active Directory or any SAML provider. Enables SSO for thousands of employees without creating individual IAM users.
E.g.: Microsoft AD, Okta, PingFederate
Web Identity Federation
Lets users authenticated with web identity providers (Cognito, Google, Facebook) assume IAM roles to access AWS.
E.g.: Amazon Cognito for mobile apps
AWS SSO (IAM Identity Center)
A centralized SSO solution for managing access to multiple AWS accounts and business applications.
E.g.: Centralized access across every account in an AWS organization
AWS IAM Identity Center centralizes access management across multiple AWS accounts and business applications. It removes the need to create IAM users in each individual account.
Key features
When to use IAM Identity Center
For the exam
IAM Identity Center = SSO across multiple AWS accounts. It integrates with AWS Organizations for centralized management.
Cross-Account Roles — cross-account access
A user or service in account A can assume a role in account B to access its resources — no need to create additional users. Credentials are temporary and revoked automatically.
Use case
A company with a production account and a separate security account. The audit team in the security account assumes a read-only role in production.
How it works
Account B creates a role with a trust policy that allows account A. A user in A calls sts:AssumeRole and receives temporary credentials for B.
Amazon Cognito — auth for web/mobile applications
Cognito provides authentication, authorization, and user management for web and mobile applications. It's not for AWS console access — it's for the users of your applications.
User Pools
A user directory for authentication. Manages sign-up, login, passwords, MFA, email verification. Returns JWT tokens.
Identity Pools
Grants authenticated users temporary AWS credentials to access services (S3, DynamoDB) directly from the app.
Service Control Policies (SCPs) — AWS Organizations
SCPs are permission-boundary policies applied to member accounts in AWS Organizations. They define the maximum permissions that users and roles in that account can have.
Critical exam point
SCPs do NOT grant permissions — they only restrict them. If a user has Allow in their IAM policy but their account's SCP has Deny, the user CANNOT perform the action. SCPs apply even to the root user of a member account.
Learn to manage identities and access with IAM, following the principle of least privilege.
+1 more...
Create an IAM policy with granular permissions using the visual editor.
+1 more...
Did you get this topic?
Test what you just learned
A systems administrator has just created a new AWS account for the company. According to AWS best practices, what should be the first action regarding the root account?
Put what you learned to the test with original CLF-C02 exam questions.
Start CLF-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.