Skip to content

CLF-C02 Study Notes: Identify AWS Access Management Capabilities

1. Why access management is needed

AWS access management controls who or what can access AWS resources and which actions they can perform.

Different people and systems require different permissions:

  • An analyst may need to view EC2 information.
  • A systems administrator may need to start, stop, and configure EC2 instances.
  • An application may need permission to read from an S3 bucket but not delete objects.

Principle of least privilege

Grant only the permissions required to perform a task—nothing more.

Benefits:

  • Reduces the risk of accidental changes.
  • Limits the impact of compromised credentials.
  • Helps meet security and compliance requirements.

Exam tip: If a question asks for the best security practice for permissions, the answer is often least privilege.

2. AWS accounts

An AWS account is:

  • The environment where AWS resources are provisioned.
  • Associated with usage and billing.
  • An authentication boundary for AWS resources.
  • Identified by a unique account ID.

Organizations may use:

  • A single AWS account for simple workloads.
  • Multiple AWS accounts for separation of environments, teams, workloads, or security boundaries.

AWS account root user

The root user is the identity created when an AWS account is first created.

It has:

  • Complete, unrestricted access to all AWS services and resources in the account.
  • Access to account-level tasks that cannot be performed by other identities.

The root user is not intended for everyday AWS activities.

Protecting the root user

Recommended protections include:

  1. Enable multi-factor authentication (MFA).
  2. Use a strong password.
  3. Securely store the root credentials.
  4. Do not use the root user for daily tasks.
  5. Do not create root access keys unless absolutely necessary.
  6. Delete or rotate root access keys if they exist.
  7. Use an administrator identity, preferably through AWS IAM Identity Center, for regular administrative work.

Examples of tasks that may require the root user

The root user may be required for limited account-level actions, such as:

  • Changing certain AWS account settings.
  • Restoring IAM user permissions.
  • Activating IAM access to the Billing and Cost Management console.
  • Managing certain account credentials or payment-related settings.

Exam trap: The root user is not the same as an IAM administrator. An IAM administrator can have broad permissions, but the root user has unrestricted access and may be required for specific account-level tasks.

3. AWS Identity and Access Management (IAM)

AWS IAM controls access to AWS resources.

IAM enables you to manage:

  • Users
  • Groups
  • Roles
  • Policies
  • MFA
  • Password policies
  • Access keys

IAM is a global service. IAM resources are not limited to a specific AWS Region.

IAM users

An IAM user represents a person or application that requires long-term credentials in an AWS account.

An IAM user can have:

  • A username and password for AWS Management Console access.
  • Access keys for programmatic access through the AWS CLI, SDKs, or APIs.
  • MFA configured for console sign-in.
  • Permissions assigned through policies or group membership.

IAM user credentials

Credential Common use
Username and password AWS Management Console access
Access key ID and secret access key Programmatic access through CLI, SDK, or API
MFA device Additional authentication factor

Password and access key controls

IAM can be configured to enforce:

  • Password complexity requirements.
  • Password expiration.
  • Password rotation.
  • MFA usage.
  • Access key rotation.

Exam tip: Long-term access keys should not be hard-coded into applications. Applications running on AWS should generally use an IAM role instead.

IAM groups

An IAM group is a collection of IAM users.

Groups help simplify permission management:

  • Attach policies to a group.
  • Add users to the group.
  • Users inherit the group’s permissions.

Examples:

  • Developers
  • Auditors
  • Administrators
  • Billing

A user can belong to multiple groups, and the user receives permissions from all applicable policies.

Exam trap: Groups contain IAM users. IAM roles cannot be added to IAM groups.

IAM roles

An IAM role is an identity with permissions that can be assumed by a trusted entity.

Roles provide temporary security credentials rather than permanent credentials.

Common IAM role use cases

  • An EC2 instance accesses an S3 bucket.
  • A Lambda function writes logs or reads from DynamoDB.
  • A user temporarily gains additional permissions.
  • A user or application accesses resources in another AWS account.
  • An external service or identity accesses AWS resources.
  • Federated users access AWS without creating long-term IAM users.

IAM role versus IAM user

IAM user IAM role
Usually represents a specific person or application Represents temporary access to permissions
Can have long-term credentials Uses temporary credentials
Suitable for certain human identities or legacy applications Preferred for AWS services, applications, and temporary access
Credentials may require rotation Temporary credentials automatically expire

Exam tip: When an AWS service needs permission to access another AWS service, the usual answer is an IAM role, not an IAM user.

4. IAM policies

A policy is a JSON document that defines permissions.

A policy specifies:

  • The allowed or denied action.
  • The resource affected.
  • The principal or identity, depending on policy type.
  • Optional conditions.

Examples of actions include:

  • s3:GetObject
  • s3:PutObject
  • ec2:DescribeInstances

Identity-based policies

Identity-based policies are attached to:

  • IAM users
  • IAM groups
  • IAM roles

They define what actions the identity is allowed to perform on resources.

Example use case:

Allow a developer group to view EC2 instances.

Resource-based policies

Resource-based policies are attached directly to resources.

Examples include:

  • S3 bucket policies
  • SQS queue policies
  • SNS topic policies

They define who can access a resource and what they can do.

Example use case:

Allow a specific IAM user or another AWS account to access objects in an S3 bucket.

IAM policy versus S3 bucket policy

Policy type Attached to Typical use
IAM identity-based policy User, group, or role Grant an identity access to resources
S3 bucket policy S3 bucket Grant access to the bucket and its objects, including cross-account access

Both use JSON-based policy language.

Exam tip: If the question specifically asks how to control access to an S3 bucket or grant another account access to an S3 bucket, consider an S3 bucket policy.

Managed and customer-created policies

AWS managed policies

  • Created and managed by AWS.
  • Can be attached to IAM users, groups, or roles.
  • AWS may update them as AWS services change.

Customer managed policies

  • Created and managed by the customer.
  • Can be customized to match the organization’s requirements.
  • Provide more control than AWS managed policies.

Inline policies

An inline policy is embedded directly into a single IAM user, group, or role.

For the CLF-C02 exam, understand the main distinction:

  • AWS managed policies: maintained by AWS.
  • Customer-managed policies: created and maintained by the customer.
  • Inline policies: directly embedded in one identity and not reusable in the same way as managed policies.

Exam trap: “Managed policy” does not always mean AWS managed policy. A customer can also create a customer-managed policy.

Basic policy evaluation concepts

When AWS evaluates permissions:

  • An explicit Deny overrides an Allow.
  • Access is not granted unless an applicable policy allows it.
  • Permissions should follow least privilege.

Exam tip: If one policy allows an action but another policy explicitly denies it, the result is Deny.

5. IAM Policy Simulator

The IAM Policy Simulator helps test and troubleshoot IAM policies.

It can be used to determine whether a user, group, or role would be allowed or denied permission to perform an AWS action.

Useful for:

  • Testing policy changes.
  • Troubleshooting unexpected access denials.
  • Reviewing the effects of identity-based and resource-based policies.

Exam trap: The IAM Policy Simulator does not grant permissions. It evaluates policies and helps troubleshoot access.

6. Amazon Cognito and temporary credentials

Amazon Cognito provides authentication and identity capabilities for applications.

Cognito User Pool

A User Pool is a user directory.

It can manage:

  • User registration.
  • User sign-in.
  • User profiles.
  • Authentication for application users.

A User Pool by itself does not provide temporary AWS credentials to unauthenticated users.

Cognito Identity Pool

An Identity Pool provides temporary AWS credentials to authenticated or unauthenticated identities.

It can support:

  • Users authenticated through social identity providers.
  • Users authenticated through a Cognito User Pool.
  • Guest users who do not authenticate.

The temporary credentials are associated with IAM roles and allow access to specified AWS resources.

User Pool versus Identity Pool

Feature Cognito User Pool Cognito Identity Pool
Main purpose User directory and authentication Temporary AWS credentials
Supports user sign-in Yes Uses identities from supported providers
Supports unauthenticated guest access No Yes
Grants temporary AWS credentials No, not by itself Yes

Exam tip: For social login or guest access that needs temporary AWS credentials, choose Amazon Cognito Identity Pool.

7. Amazon S3 MFA Delete

MFA Delete adds an additional layer of protection against accidental or unauthorized deletion of S3 objects.

To use MFA Delete:

  • S3 bucket versioning must be enabled.
  • An MFA device is required for certain operations, such as permanently deleting object versions.
  • It helps protect object versions from deletion.

Exam trap: MFA Delete requires S3 Versioning to be enabled first. MFA on an IAM user or root user alone is not the same as enabling S3 MFA Delete.

8. Access management comparisons

IAM role versus access key

IAM role Access key
Temporary credentials Long-term credentials
Preferred for AWS services and applications Used for CLI, SDK, and API access
Credentials expire automatically Must be securely stored and rotated
Reduces credential exposure Can be compromised if hard-coded or leaked

Root user versus IAM administrator

Root user IAM administrator
Created with the AWS account Created or managed through IAM/IAM Identity Center
Unrestricted access Only has permissions granted by policies
Used only for limited account tasks Used for normal administrative operations
Should be protected with MFA Should also use MFA

Identity-based policy versus resource-based policy

Identity-based policy Resource-based policy
Attached to a user, group, or role Attached to a resource
Defines what the identity can do Defines who can access the resource
Example: IAM policy Example: S3 bucket policy

9. Common exam tips and traps

  • Do not use the root user for daily activities.
  • Enable MFA on the root user.
  • Use IAM roles for AWS services and applications.
  • Use temporary role credentials instead of embedding long-term access keys in code.
  • Use IAM groups to manage permissions for multiple users.
  • An IAM policy does not automatically grant access unless it contains an applicable Allow.
  • An explicit Deny overrides an Allow.
  • Use an S3 bucket policy to control access directly at the bucket level, especially for cross-account access.
  • Use IAM Policy Simulator to test policies; it does not change permissions.
  • Use a Cognito Identity Pool for temporary AWS credentials, including guest access.
  • A Cognito User Pool is primarily a user directory and authentication service.
  • S3 MFA Delete requires versioning.
  • IAM users can have console passwords and/or programmatic access keys.
  • Groups contain users; roles are assumed by trusted entities.
  • AWS managed policies are maintained by AWS; customer-managed policies are maintained by the customer.

10. Example CLF-C02 questions

Question 1

A company wants to allow an EC2 instance to read objects from an S3 bucket. The company does not want to store long-term access keys on the instance. Which solution should be used?

A. Create an IAM user and store its access keys on the instance
B. Attach an IAM role with the required S3 permissions to the EC2 instance
C. Use the AWS account root user credentials
D. Create an IAM group and attach it to the EC2 instance

Answer: B

Explanation: IAM roles provide temporary credentials for AWS services and applications. Long-term credentials should not be stored on an EC2 instance.

Question 2

Which identity should be used for regular administrative activities in an AWS account?

A. AWS account root user
B. An IAM user or administrator in AWS IAM Identity Center
C. An anonymous user
D. An S3 bucket owner without an IAM policy

Answer: B

Explanation: The root user should be protected and used only for limited account-level tasks. AWS recommends using an administrator identity for daily activities.

Question 3

A company wants to grant a different AWS account access to objects in an S3 bucket. Which solution is most appropriate?

A. Create an S3 bucket policy
B. Enable MFA on the root user
C. Create an IAM group in the other account
D. Use the IAM Policy Simulator

Answer: A

Explanation: An S3 bucket policy is a resource-based policy that can grant access to IAM identities or principals in another AWS account.

Question 4

Which AWS service can provide temporary AWS credentials to users who sign in through a social identity provider and to unauthenticated guest users?

A. Amazon Cognito User Pool
B. Amazon Cognito Identity Pool
C. AWS IAM Policy Simulator
D. AWS Organizations

Answer: B

Explanation: Cognito Identity Pools provide temporary AWS credentials for authenticated and unauthenticated identities.

Question 5

An administrator wants to test whether an IAM role can perform a specific AWS API action. Which service should be used?

A. AWS CloudTrail
B. IAM Policy Simulator
C. Amazon Inspector
D. AWS Trusted Advisor

Answer: B

Explanation: The IAM Policy Simulator evaluates policies and helps troubleshoot whether access would be allowed or denied.

Question 6

A company wants to protect S3 objects from accidental deletion. Which combination is required to use S3 MFA Delete?

A. S3 encryption and an IAM group
B. S3 Versioning and MFA Delete
C. An S3 lifecycle rule and an IAM role
D. An S3 access point and a bucket ACL

Answer: B

Explanation: S3 MFA Delete requires S3 Versioning to be enabled and adds MFA protection for certain deletion operations.

Question 7

Which statement about IAM policies is correct?

A. AWS manages all IAM policies
B. Customer-managed policies are created and maintained by customers
C. IAM policies can only be attached to IAM users
D. An explicit Allow always overrides an explicit Deny

Answer: B

Explanation: Customers create and manage customer-managed policies. An explicit Deny overrides an Allow.

Question 8

A security team wants to enforce the principle of least privilege. What does this mean?

A. Give every employee administrator access
B. Give users access to all resources in their AWS account
C. Give users only the permissions required to perform their job
D. Use the root user for all administrative tasks

Answer: C

Explanation: Least privilege means granting only the permissions necessary to perform required tasks.