IAM users, groups and policies: CLF-C02 study notes and practice questions
What to know about IAM users, groups and policies for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 2 free questions to test it. Part of the CLF-C02 study guide.
AWS Identity and Access Management (IAM) is how you control access to an AWS account. It is a global service with no extra charge.
The building blocks
Item
What it is
User
An identity for one person or application, with long-term credentials (a password and/or access keys)
Group
A collection of users; policies attached to the group apply to every member
Role
An identity with temporary credentials that users, applications or AWS services assume
Policy
A JSON document that allows or denies actions on resources
Key facts
Least privilege: give each identity only the permissions it needs. Start small and add more if needed.
Groups for people: attach policies to groups (such as Developers or Finance), not to each user.
Roles for applications and services: an application on EC2 should use a role through an instance profile, not access keys stored on the instance.
Roles for cross-account access let users in one account work in another without a second set of credentials.
MFA adds a second factor to sign-in; turn it on for every user, especially the root user.
Password policies set length and complexity rules for IAM users.
The IAM credential report lists every user and the status of their passwords, access keys and MFA. IAM Access Analyzer finds resources shared outside your account and unused access.
AWS managed policies are prebuilt by AWS for common jobs; customer managed policies are written by you.
Common traps
Sharing one IAM user between people. Each person gets their own identity, so actions can be traced.
Access keys on EC2. Use a role.
Using the root user for daily work. Create IAM users or use IAM Identity Center instead.
Groups can’t be nested, and a group isn’t an identity that can sign in.
An application on Amazon EC2 instances must write files to one Amazon S3 bucket.
The security team forbids long-term access keys on the instances, and it requires the application to have only the permissions it needs.
What should the company use?
Choose one answer.
AA. An IAM user's access key, stored in an encrypted file on each instance
BB. A role attached through an instance profile, with the AdministratorAccess policy
CC. A role attached through an instance profile, allowing writes to one bucket only
DD. The root user's access keys, saved as an environment variable on each instance
Show the answer and explanation
Answer: C
A. Wrong: This is a long-term credential stored on the instances, which the security team forbids. Encrypting the file does not change that.
B. Wrong: The role supplies temporary credentials, so no long-term keys are stored. But AdministratorAccess grants far more than writing to one bucket, which breaks the least-privilege requirement.
C. Right: Correct. The role supplies temporary credentials that AWS rotates automatically, so nothing long-term is stored on the instances. Its policy limits the application to writing to this one bucket. Learn more: Security best practices in IAM (opens in a new tab)
D. Wrong: Root user credentials have unrestricted access and should never be used by applications. Storing them on instances also creates long-term keys, which the policy forbids.
Explanation
IAM roles are the recommended way to give applications on EC2 access to AWS. The instance profile supplies temporary credentials that AWS rotates automatically, so no long-term keys sit on the instance. Least privilege means the role's policy should allow only the actions the application needs, such as writing to one bucket.
An auditor asks for one file that lists every IAM user in a single AWS account, showing whether each user has MFA turned on and when each user's access keys were last rotated.
The file must open in a spreadsheet.
What is the quickest way to provide it?
Choose one answer.
AA. Run IAM Access Analyzer and export its findings for the account
BB. Export the last-accessed data from IAM Access Advisor for each user
CC. Download the AWS Artifact report for the account from the console
DD. Generate and download the IAM credential report as a CSV file
Show the answer and explanation
Answer: D
A. Wrong: Access Analyzer finds resources shared with outside accounts. It does not list MFA status or key rotation dates for each user.
B. Wrong: Access Advisor shows which services a user or role has used and when. It does not show MFA status or when access keys were rotated.
C. Wrong: AWS Artifact provides AWS's own compliance reports and agreements, not details about the customer's IAM users.
The IAM credential report is generated per account and downloaded as a CSV file. It lists every IAM user with columns such as mfa_active and access_key_1_last_rotated, which is what the auditor needs. The other options answer different questions: Access Analyzer finds shared resources, Access Advisor shows service use, and Artifact holds AWS's own compliance documents.
Want more on IAM users, groups and policies? The 5 full-length practice sets have 10 more IAM users, groups and policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →