4.1 - Identity and data protection (IAM, KMS, Secrets Manager)
AWS SysOps Administrator objective 4.1 covers securing access and protecting data. IAM policy evaluation follows least privilege: an explicit Deny always wins, and the effective permissions are the intersection of identity policies, permission boundaries and Service Control Policies. You attach roles to services rather than storing keys, use instance profiles, and review access with the credential report and IAM Access Analyzer. AWS KMS protects data with customer managed keys governed by key policies and grants, supports yearly automatic rotation, aliases and multi-Region keys, and underpins encryption at rest for S3, EBS, RDS and DynamoDB. Secrets Manager stores credentials and rotates them with Lambda, while Parameter Store SecureString is a cheaper option without native rotation. Expect scenario questions about a denied action, rotating a key or secret, or encrypting data, and ask which IAM, KMS or secrets feature fits.
Effective permission = identity policy intersect boundary intersect SCP, and an explicit Deny always wins. Rotate credentials automatically = Secrets Manager. Encrypt at rest with a governed key = KMS customer managed key.
Practice questions
1. You want a CloudWatch billing alarm on EstimatedCharges. In which region must you create it?
- US East (N. Virginia), us-east-1 (correct answer)
- Any region, as long as billing metrics are enabled globally beforehand
- The region that is closest to your primary production workloads
- EU (Ireland), eu-west-1, the default billing home region
Billing metrics (EstimatedCharges) are only published in us-east-1, so the alarm must be created there. You must also enable 'Receive Billing Alerts' first, but that does not move the metric to another region.
2. What is the recommended way to grant EC2 instances permission to send metrics and logs via the CloudWatch agent?
- Attach an IAM role with the CloudWatchAgentServerPolicy to the instances (correct answer)
- Embed a long-lived IAM user access key inside the agent config file on disk
- Open the instances to the public internet on TCP port 443
- Disable IMDS so that the agent falls back to anonymous access
Attaching an instance role with the managed CloudWatchAgentServerPolicy provides temporary, rotated credentials via IMDS, the secure best practice. Hardcoding a long-lived access key is a security risk and unnecessary.
3. Instances launched by an Auto Scaling group must call S3 without static keys. Where do you attach the permissions in the launch template?
- Hardcode access keys in user data
- A security group inbound rule
- An IAM instance profile (role) (correct answer)
- A NACL on the subnet
An IAM instance profile attaches a role so instances get temporary rotating credentials with no static keys. Security groups and NACLs control network traffic, and hardcoded keys are a serious security risk.
4. Auditors require CloudWatch Logs to be encrypted with a key you control. What do you do?
- Move all logs to an S3 bucket because log groups cannot be encrypted
- Enable SSE on the subscription filter that streams the log events
- Associate a customer managed KMS key with the log group (correct answer)
- Turn on a special compliance mode that quietly rotates an AWS-owned key for you
You associate a customer managed KMS key with the log group so encryption uses a key you own and audit. Log groups are encryptable, subscription filters have no SSE toggle, and there is no hidden auto-rotating compliance mode.
5. You attach a customer managed KMS key to a log group but ingestion fails. What is the usual cause?
- The log group retention is set higher than the KMS key allows it to be
- The KMS key policy does not allow the CloudWatch Logs service principal (correct answer)
- Customer managed keys cannot be used with CloudWatch Logs, only S3
- The agent must be reinstalled from scratch every time a new key is attached
The KMS key policy must grant logs.<region>.amazonaws.com the encrypt/decrypt actions with the right condition, or CloudWatch Logs cannot use the key and ingestion breaks. Retention is unrelated, CMKs are supported, and the agent needs no reinstall.
6. A Synthetics canary must write its screenshots and HAR files to S3. What grants that access?
- A resource policy on the CloudWatch dashboard
- A public bucket ACL open to anyone on the internet
- The canary's IAM execution role with S3 permissions (correct answer)
- A security group rule allowing outbound traffic to the S3 service
A canary runs as a Lambda-based function assuming an IAM execution role, so S3 write permissions on that role let it store artifacts. A dashboard policy is unrelated, a public ACL is insecure and unnecessary, and a security group controls network reachability, not S3 authorization.