Identity, Access, and Privileged Account Management
This domain tests how you prove who can do what in cloud environments, with emphasis on federation, least privilege, and controlling privileged paths.
Core rules
- Protect the root or global administrator: hardware MFA, no day-to-day use, a break-glass procedure, and alerting on use.
- Prefer federation (SAML or OIDC) and role assumption over long-lived users and access keys. Require MFA and use session policies.
- Grant least privilege with roles, conditions, permission boundaries, and regular access reviews; use CIEM to find unused and excessive permissions.
- Privileged access management: just-in-time elevation, approval workflow, session logging, credential rotation, and secrets vaulting.
- Separate duties: whoever can change IAM policy should not also approve their own change.
Worked example
An on-call engineer needs production read access during an incident. Instead of a permanent admin role, the team uses a time-bound role assumption requiring MFA and an approval ticket; the session policy allows only read actions and CloudTrail logs the session. Reasoning: the need is temporary and read-only, so standing admin violates least privilege; approval and logging provide accountability.
Traps
- Leaving access keys in code or CI variables.
- Using wildcard actions or resources in policies.
- Shared accounts that destroy non-repudiation.
- Forgetting workload identities and service accounts in access reviews.