What's changed: Deepened SCS-C02 Chapter 4 (added comparison tables, scenarios, FAQs, exam traps, deep-dive paragraphs to each section; localized figures to Japanese)
4.3Achieving Least Privilege and Auditing
Understand minimizing permissions—IAM Access Analyzer, Access Advisor (last-accessed), policy validation, temporary roles, and root user protection. Continually trim excess permissions.
Keep permissions minimal over time. Detect unused permissions, analyze external exposure, and protect the root user.
4.3.1Least privilege and auditing
- IAM Access Analyzer: detect external exposure and unused access to support least privilege.
- Access Advisor: use last-accessed info to identify and trim unused permissions.
- Temporary roles: prefer temporary roles over long-lived users for people, reducing attack surface.
- Root user protection: strictly protect via MFA required, no daily use, remove access keys.
Common on SCS-C02: detect external exposure/unused access = IAM Access Analyzer, identify unused permissions = Access Advisor (last-accessed), people use temporary roles (cut long-lived keys), root = MFA + no daily use + remove keys. Never create (or remove) root access keys.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.