What's changed: Deepened SCS-C02 Chapter 4 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
4.1IAM Policies and Evaluation Logic
Understand the core of access control—identity/resource-based policies, explicit deny wins, SCPs, permissions boundaries, and condition keys. Precisely design who can access what.
IAM is central to security. Understand precisely how multiple policies evaluate—especially that explicit deny wins.
4.1.1Policy evaluation flow
- Explicit deny wins: an explicit Deny anywhere always denies (highest precedence).
- Allow required: access needs an explicit Allow in some policy; otherwise implicit deny.
- SCP/permissions boundary: define the permission ceiling (no grant); effective permission is the intersection.
- Condition keys: narrow allows by MFA/source IP/tags/required encryption, etc.
Most common on SCS-C02: explicit deny always wins, allow needs an explicit Allow else implicit deny, SCP/boundary are ceilings (intersection), not grants, condition keys for MFA/IP/tag restrictions. Access requires allow across SCP, boundary, IAM, AND resource policy.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.