Section 1
Architectural Foundations
Preview
Preview: Design Secure Architectures
- 4 of 41 lesson topics
- 1 overview segment
- 3 core concepts
- 2 exam tips
Lesson Topics
- Assign an IAM Role
- Federated Least-Privilege Access
- Temporary Elevated IAM Roles
- Third-Party IAM Role Access
Overview
The exam tests designing secure architectures within AWS, a critical domain for ensuring data protection, compliance, and operational resilience. It emphasizes the principles of least privilege, defense in depth, and automation to minimize risk and simplify management.
Core Concepts
- **IAM Roles:** An IAM role is an AWS identity with permissions and a trust policy. A trusted principal assumes the role, and AWS STS issues temporary security credentials for the resulting role session; roles do not contain long-term credentials themselves.
- **Cross-Account Access:** A target-account role trust policy identifies who can assume the role, the role permissions policy defines what the session can do, and the calling principal also needs permission to call `sts:AssumeRole`. External IDs, MFA, session duration, source identity, session tags, SCPs, permission boundaries, and resource policies can affect access.
- **STS (Security Token Service):** STS issues temporary security credentials for trusted principals that assume roles or use supported federation flows. Effective permissions can be shaped by role policies, session policies, permission boundaries, SCPs, and resource policies.
Exam Tips
- Prioritize solutions that avoid long-term credentials and use roles, trust policies, scoped permissions, and STS-issued temporary credentials.
- Always consider the principle of least privilege when designing access controls.