2.2 - AWS Identity and Access Management (IAM)
AWS Certified Cloud Practitioner objective 2.2 covers AWS Identity and Access Management (IAM), which controls who can do what in your account. An IAM policy is written in JSON and grants or denies permissions. The principle of least privilege means granting only the permissions required to perform a task, limiting damage from a mistake or a compromised identity. Applications running on an EC2 instance should use an IAM role (an instance profile) to get temporary, automatically rotated credentials, rather than long-term access keys embedded in code. Assigning permissions to a group and adding users to that group applies role-based access at scale. The most important protection is to enable MFA on the root user and lock its credentials away, using IAM identities for daily work. Expect scenario questions that describe granting access or securing an identity and ask which IAM concept applies.
Permissions in JSON, allow/deny = IAM policy. Only what the task needs = least privilege. App on EC2 gets temporary creds = IAM role (instance profile), not access keys. Protect root = MFA + lock away, use IAM daily.
Practice questions
1. Which IAM entity should applications on an EC2 instance use to get temporary AWS credentials?
- The root user access keys
- A hard-coded IAM user secret key
- An IAM role (instance profile) (correct answer)
- The account password
Attach an IAM role to the instance; apps then receive automatically rotated temporary credentials — never hard-code keys and never use root.
2. An IAM policy is written in which format and does what?
- YAML; it launches EC2 instances
- XML; it stores billing data
- Binary; it encrypts volumes
- JSON; it grants or denies permissions (correct answer)
IAM policies are JSON documents attached to users, groups, or roles that allow or deny actions on resources. Least privilege = grant only what's needed.
3. Which practice most improves the security of the AWS account root user?
- Use the root user for daily administration
- Share root credentials with the operations team
- Create an access key for the root user
- Enable MFA on root and lock its credentials away (correct answer)
AWS recommends enabling MFA on the root user and avoiding its everyday use. Sharing credentials or creating root access keys increases risk.
4. What is the recommended way to grant an EC2 instance permission to read from an S3 bucket?
- Attach an IAM role to the instance (correct answer)
- Store root access keys on the instance
- Hard-code an IAM user's secret key in the app
- Disable the bucket policy
IAM roles provide temporary, automatically rotated credentials to EC2, avoiding hard-coded secrets. Storing long-term keys on the instance is discouraged.
5. An administrator must give 20 developers the same set of permissions efficiently. What is the best IAM approach?
- Attach policies individually to each user
- Share one IAM user among all developers
- Use the root user for all developers
- Create an IAM group with the policy and add users to it (correct answer)
IAM groups let you attach a policy once and apply it to all members, simplifying management. Sharing users or using root violates best practices.
6. What does enabling multi-factor authentication (MFA) add to a standard username and password sign-in?
- A second, time-based or device-based verification factor (correct answer)
- Automatic password rotation for the user
- Encryption of all S3 objects
- A dedicated private network link
MFA requires an additional factor (such as a code from an authenticator app or hardware token) beyond the password, greatly reducing account compromise.