← AWS Certified Security - Specialty
AWS · objective · 20% of the exam
Identity and Access Management
Exam objectives are the official skill domains AWS Certified Security - Specialty tests. Below are the official AWS docs our questions on this objective cite — review them, then practise.
Sign in to track your progress on this objective.
Official references for this objective
-
Amazon Web Services — Policies and permissions in AWS Identity and Access Management - AWS Identity and Access Management
Adding a cross-account principal to a resource-based policy is only half of establishing the trust relationship
-
Amazon Web Services — Request temporary security credentials - AWS Identity and Access Management
to an existing IAM user. This is useful for providing enhanced security, such as allowing AWS requests only when MFA is enabled
-
Amazon Web Services — Control access to AWS resources using policies - AWS Identity and Access Management
Every IAM user starts with no permissions. In other words, by default, users can do nothing, not even view their own access keys.
-
Amazon Web Services — Permissions boundaries for IAM entities - AWS Identity and Access Management
"iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/XCompanyBoundaries"
-
Amazon Web Services — Temporary security credentials in IAM - AWS Identity and Access Management
You can let users sign in using a well-known third-party identity provider such as Login with Amazon, Facebook, Google, or any OIDC-compatible provider.
-
Amazon Web Services — Granting permissions to create temporary security credentials - AWS Identity and Access Management
No permissions are required for a user to call GetSessionToken . The purpose of this operation is to authenticate the user using MFA.
-
Amazon Web Services — IAM - Multi-Factor Authentication
FIDO authentication standards are based on public key cryptography, which enables strong, phishing-resistant authentication that is more secure than passwords.
-
Amazon Web Services — Identity-based policies and resource-based policies - AWS Identity and Access Management
the requester in Account A must have an identity-based policy that allows them to make a request to the resource in Account B
-
Amazon Web Services — Policy evaluation logic - AWS Identity and Access Management
the resulting permissions are the intersection of the user's policies, service control policies (SCPs), and resource control policy (RCP). This means that an action must