Identity, Access, and Credential Management in the Cloud
What this domain tests
Identity, Access, and Credential Management in the Cloud tests policy evaluation, federation, least privilege, and credential lifecycle. You must know the difference between authentication and authorization, how roles and trust policies work, and why temporary credentials beat static keys.
Core rules and concepts
- Cloud IAM generally evaluates policies as deny by default, explicit deny wins, and allowed actions are the union of identity-based and resource-based policies, subject to boundaries such as permissions boundaries and SCPs.
- Federate human access through SAML or OIDC to a central IdP; enforce MFA, conditional access, and short session lifetimes. Avoid local IAM users for workforce access.
- Use roles and STS-style temporary credentials for workloads. A trust policy defines who may assume a role; the permissions policy defines what the role can do.
- Apply least privilege with scoped actions, resource ARNs, conditions (MFA, source network, tags), and regular access reviews. Separate privileged administration from everyday accounts.
- Store secrets in a managed secrets service with rotation, auditing, and fine-grained access; never in code, images, or CI variables that are broadly readable.
Worked example
An application in account A must read objects in account B. Do not create a static access key in account B. Create a role in account B whose trust policy allows account A's workload identity, attach a read-only policy scoped to the bucket prefix, and have the workload call STS to assume it. The application receives short-lived credentials; CloudTrail records the session; revocation is a trust-policy change. The reasoning is that the resource owner controls access and credentials expire.
Traps that cost marks
- Using wildcard actions or resources in production policies.
- Assuming an explicit allow overrides an explicit deny.
- Treating authentication as authorization.
- Leaving root/global admin accounts without MFA or hardware key.
- Long-lived keys embedded in pipelines or repositories.
- Forgetting that role chaining and session duration affect revocation.