Security, Identity, and Compliance
What the exam tests
Security, Identity, and Compliance tests least-privilege identity, encryption, network segmentation, secrets management, auditability, and guardrails. Expect IAM roles, federation, KMS, security groups, SCPs, and compliance evidence.
Core rules
- Deny by default. Grant roles, not users; prefer short-lived credentials via federation over long-lived access keys.
- Enforce least privilege with conditions such as source IP, MFA, and resource tags, plus regular access reviews.
- Encrypt data at rest with customer-managed KMS keys where regulation requires; enforce TLS in transit.
- Use organization guardrails (SCPs, Azure Policy) to block risky actions, and centralize audit logs in an immutable account.
Worked example
A partner needs read access to one S3 prefix in your account. Create an IAM role with a trust policy requiring the partner account ID and an external ID; attach a policy allowing s3:GetObject on arn:aws:s3:::data/partner/* only. Reasoning: the external ID prevents the confused-deputy problem; the resource ARN scopes access; no access keys are exchanged.
Traps
Wildcard * actions or resources. Long-lived access keys in code. Public S3 buckets or security groups open to 0.0.0.0/0 on admin ports. Unencrypted volumes. Missing CloudTrail or equivalent audit logs.