What's changed: Deepened SOA-C02 Chapter 4 to Associate depth (tables, scenarios, FAQ, traps; localized figures)
4.1IAM and Access Management (Operations View)
Understand IAM identity-based/resource-based policies, evaluation logic (explicit deny wins, default deny), roles and temporary credentials, and least-privilege operations. The starting point for "Security and Compliance" in SOA-C02.
In operations, correctly managing who can access what—and understanding the evaluation logic when troubleshooting—is key. Know IAM policy types and the evaluation order.
4.1.1Policies and evaluation logic
- Identity-based: attached to users/groups/roles. Resource-based: on the resource (e.g., S3 bucket policy).
- Evaluation: explicit Deny wins; with no deny and an allow present, access is granted. Default is implicit deny.
- Roles + temporary credentials: attach roles to EC2/Lambda; never embed keys.
Common on SOA: explicit deny wins, default is deny, when access fails, suspect a Deny and boundaries (SCP/permissions boundary) first, cross-account access = resource-based policy + roles.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.