Exam objective 3.2 asks you to describe AWS Identity and Access Management (IAM). This topic is the single most important security concept for the CLF-C02 exam and for any real-world use of AWS, because IAM controls who can do what inside your cloud account. Without understanding IAM, you cannot safely or effectively use any other AWS service.
Jump to a section
What if anyone could walk into your apartment building, open your front door, and help themselves to your belongings?
That is what the cloud would be like without a system to control who gets in and what they can do once inside. AWS Identity and Access Management (IAM) is like the security desk at a gated community. The security desk does not let anyone wander in. First, you must prove who you are—that is authentication, or proving your identity, like showing your ID card. But even after you are inside, the security guard does not let you go into every house. If you are a plumber visiting Unit 12, the guard lets you enter only that unit, not the pool house or the storage shed. That restriction is authorisation—deciding what you are allowed to do after they know who you are.
In this analogy, the gated community is your whole AWS account. Each house inside is a specific AWS service, like your data storage or your virtual servers. The security desk holds a master list that says exactly who gets in, which houses they can enter, and whether they can use a key (read data), rearrange the furniture (write data), or even knock down a wall (delete resources). IAM is that master list, the security rules, and the identity-checking process all rolled into one. It lets you grant different levels of access to different people—or even to other computer programs—without ever giving out the master key to your entire cloud community.
AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. Think of it as the security guard, the front door lock, and the sign-in book all in one. In the early days of cloud computing, companies often shared one set of login credentials—like a single username and password—for everyone in the organisation. That was risky, because if that one set of credentials leaked, a bad actor could do anything: delete all data, spin up expensive servers, or even shut down the entire account. IAM solved that problem by letting you create separate identities for each person or application that needs access.
The most basic building block in IAM is the user. An IAM user is a permanent identity you create to represent a person or a service. Each user gets their own set of credentials, typically a username and password for the AWS Management Console, or access keys for programmatic access via the command line or APIs. You can also create groups, which are collections of users. Instead of attaching permissions to each user one by one, you attach permissions to a group, and then you add users to that group. For example, you could create a group called Developers and give it permission to deploy code; then you add all your developer users to that group. When a developer leaves the company, you simply remove them from the group.
The real power of IAM comes from iam-roles. A role is an identity that does not belong to a specific user but can be assumed by anyone who needs it. Roles are temporary. Imagine a security badge a visitor wears: it gives them access only for that day, and it expires at the end of their visit. In AWS, you can use a role to give a virtual machine (like amazon-ec2) permission to read data from a storage bucket. The virtual machine does not have its own set of permanent credentials; instead, it uses the role to request temporary credentials that AWS rotates frequently. This is much more secure than storing a long-lived password on the machine itself.
Permissions in IAM are defined by policies. A policy is a document written in JSON (JavaScript Object Notation) that states what actions are allowed or denied on which resources. A policy might say: Allow action 's3:GetObject' on resource 'arn:aws:s3:::my-company-bucket/*'. Translated to plain English: Let the identity read any file from the bucket named my-company-bucket. When a user tries to perform an action, AWS checks all the policies attached to that user, the groups they belong to, and any roles they are using. By default, everything is denied. You have to explicitly allow actions. There is also a concept called an explicit deny: if a policy says 'Deny' an action, that action is blocked even if another policy says 'Allow' it. The deny always wins.
IAM also offers fine-grained control through conditions. You can say, 'Allow access only if the request comes from the company's office network' or 'Allow this action only between 9 AM and 5 PM.' This is crucial for exam questions about security best practices.
Finally, IAM is global. That means you set it up once, and it applies to all AWS regions around the world. There is no need to configure IAM separately in each region. However, the resources you protect with IAM (like a virtual server or a storage bucket) are usually regional. The IAM identity can access resources in any region, but the permissions must match the specific resource you are targeting.
In summary, IAM is the foundation of security on AWS. It lets you create individual users, group them, use temporary roles, and write precise policies to control every action someone can take. Understanding this core_explanation is essential not only for passing the CLF-C02 exam but also for building secure systems in the cloud.
Create an IAM user
In the AWS Management Console, you navigate to IAM and choose 'Create user'. You give the user a name (e.g., 'jane.doe') and select whether they need console access (with a password) or programmatic access (with access keys). This step creates a distinct identity that AWS can use to authenticate the person or application.
Add the user to an IAM group
You create or select an existing group, such as 'Developers'. You add the new user to that group. The benefit is that permissions are attached to the group, not to the individual user. If you later change the group's policy, all members automatically get the updated permissions.
Attach a policy to the group
You attach an AWS managed policy (like 'AmazonS3ReadOnlyAccess') or a custom policy to the group. This policy defines what actions the group members can perform on which resources. For example, the policy might allow reading objects from a specific S3 bucket.
The user logs in and attempts an action
Jane Doe logs into the AWS Console using her username and password. She tries to list the contents of an S3 bucket. IAM receives the request and evaluates all applicable policies: the group policy (which allows read access) and any user-specific policies. If the combined policies allow the action, it is granted. If a deny exists, it is blocked.
Enable MFA for enhanced security
As a best practise, you add Multi-Factor Authentication to the user's account. Jane must now enter a temporary code from an app on her phone when she logs in. IAM checks that the correct code is provided, which prevents unauthorised access even if her password is stolen.
Consider a real company called EcoRetail, which runs its online store on AWS. Four people need access: a database administrator (DBA), a front-end developer, an intern, and an auditor who checks past account activity. The IT administrator uses IAM to create a separate user for each person.
The DBA gets attached to a group called DBAdmins, which has a policy that allows full control over the RDS database service. The developer gets attached to a Developers group, which has permissions to read and write to the code repository in AWS CodeCommit and to deploy code to a staging server. The intern is placed into a ReadOnly group that allows viewing resources but nothing else. The auditor gets a special IAM role that grants read-only access to CloudTrail logs, but only for the previous 90 days and only during office hours (using a condition in the policy).
Here is what happens step by step when the DBA logs in: \ - The DBA navigates to the AWS Management Console and enters their username and password. IAM authenticates them. \ - If the DBA has enabled multi-factor authentication (MFA), they also type a temporary code from their phone. IAM verifies that code. \ - Once signed in, the DBA tries to list all databases. IAM checks the policies attached to the DBAdmins group (of which the DBA is a member). The policy says allow 'rds:*' (all RDS actions). IAM grants the request. \ - Next, the DBA tries to list virtual servers (EC2). IAM checks again: the DBAdmins group policy does not allow any EC2 actions. By default, everything is denied, so IAM blocks the request and returns a '403 Forbidden' error.
The intern later tries to delete a database. Because their ReadOnly group policy only allows actions like 'rds:DescribeDBInstances' (to view databases) and does not include 'rds:DeleteDBInstance', the request is denied. This prevents an accidental or malicious deletion.
The auditor assumes the auditor role. They do not have a password for permanent access; instead, they switch to the role from their own personal AWS account. The role gives them temporary credentials that expire after one hour. They run a report on CloudTrail logs, and when the report is done, they abandon the role. This is called the principle of least privilege—giving each person only the minimum permissions they need to do their job.
This real-world example shows how IAM replaces the old, dangerous practice of sharing a single root user password. It gives the IT team granular control, improves security, and makes auditing who did what much easier. For the CLF-C02 exam, you must know that IAM is free (you pay only for the storage of some logs, not for the service itself) and that you should never use the root user for everyday tasks.
The CLF-C02 exam tests your understanding of IAM in several specific ways. First, you will see questions that ask you to identify the correct type of identity: is it a user, a group, or a role? The exam likes to present a scenario (e.g., 'a new employee joins the company') and ask what you should do: create an IAM user and add them to a group. A trap is describing the creation of a new IAM role for a person—roles are for temporary access, not for permanent employee accounts.
Second, expect questions about policy evaluation logic. The exam will describe a situation where a user has two policies: one allows an action, and one denies it. The correct answer is that the deny overrides the allow. Memorise this: explicit deny always wins.
Third, the exam tests the concept of least privilege. You will be asked which approach is the most secure: giving full admin permissions to everyone, or giving only the specific permissions needed. The answer is always to apply least privilege.
Fourth, know that IAM is a global service, not a regional one. A common trap question asks: 'You need to configure IAM in the us-east-1 region and also in eu-west-2. What should you do?' The correct answer is that you only configure it once because it is global.
Fifth, you must be familiar with iam-role use cases. The exam often asks: 'How do you give an EC2 instance permission to access an S3 bucket?' The answer is to create an IAM role and attach it to the EC2 instance. The exam will try to trick you with options like 'store the AWS access keys on the instance' (insecure) or 'create an IAM user for the instance' (incorrect—instances use roles, not users).
Finally, the exam loves to test what the root user can and cannot do. The root user is the email address you used to sign up for AWS. It has unlimited access. You should never use it for daily tasks. You should enable MFA on it and use it only for a few specific tasks, such as changing your account name or closing the account.
Key definitions to memorise for the exam: \ - IAM User: A permanent identity for a person or application with long-term credentials. \ - IAM Group: A collection of users; permissions attached to the group apply to all members. \ - IAM Role: A temporary identity for a resource or a federated user; uses temporary credentials. \ - Policy: A JSON document that defines permissions (allow or deny). \ - MFA (Multi-Factor Authentication): An extra layer of security that requires a code from a device in addition to a password. \ - Least Privilege: The security principle of granting only the permissions needed to perform a task.
IAM is a global service that controls access to all AWS resources and is free to use.
The root user has unrestricted access and should only be used for account-level tasks, with MFA enabled.
IAM users are permanent identities for people or applications, while IAM roles provide temporary credentials.
IAM groups simplify permission management by allowing you to attach policies to a group and add users to it.
An explicit deny in any policy overrides any allow—this is the core of policy evaluation logic.
The principle of least privilege means granting only the permissions necessary to perform a specific job.
Policies are JSON documents that define allowed or denied actions on AWS resources.
IAM roles are the correct way to give an EC2 instance or other AWS service permission to access resources.
Multi-Factor Authentication (MFA) adds a second layer of security beyond a password and is best practise for all users.
You can use conditions in policies to restrict access based on time, IP address, or other factors.
These come up on the exam all the time. Here's how to tell them apart.
IAM User
Permanent identity with long-term credentials (password or access keys)
Used for people or applications that need consistent access
Exists independently until you delete it
IAM Role
Temporary identity with short-lived credentials
Used for services (like EC2) or for federated access
Cannot be used for direct login; must be assumed
IAM Policy - Allow
Permits a specific action on a resource
Is overridden if an explicit deny exists
Usually follows the principle of least privilege when used alone
IAM Policy - Deny
Blocks a specific action even if another policy allows it
Always takes priority over any allow statement
Often used to safeguard sensitive resources from accidental changes
IAM Groups
A collection of IAM users
Policies attached to the group apply to all members
Users are added to and removed from groups
IAM Roles
An identity that can be assumed by users, services, or external identities
Policies attached to the role define the permissions when the role is assumed
Provides temporary credentials for a specific context
Root User
Unlimited access to all AWS resources and billing
Cannot be restricted by IAM policies
Should be used only for account-level tasks (e.g., closing account)
IAM Admin User
Governed by IAM policies and can be restricted
Can be given admin permissions via a policy, but can still be limited
Intended for everyday management tasks
Mistake
IAM users and AWS accounts are the same thing—if I create an IAM user, they own the account.
Correct
The AWS account is the container (the 'root' owner). IAM users are separate identities inside that account. The root user owns the account and can manage billing; IAM users are controlled by the root and have only the permissions you give them.
Beginners hear 'user' and think 'account owner'. The exam tests whether you know the root user is different from an IAM user.
Mistake
IAM roles can be used by anyone, anywhere, for as long as they want.
Correct
Roles provide temporary credentials that have a session duration (usually 1 to 12 hours). They are meant for specific scenarios, like an EC2 instance needing to read from S3, not for everyday human logins.
The word 'role' sounds open-ended. New learners mistakenly treat roles as permanent accounts. The exam likes to test this distinction between users (permanent) and roles (temporary).
Mistake
A policy that allows an action will always work.
Correct
An explicit deny in any policy overrides any allow. Also, if the resource itself has a resource-based policy (like an S3 bucket policy) that denies the action, the IAM policy allow is not enough.
People learn about 'allows' first and forget that denies exist. The exam frequently uses the deny override as a trick in scenario questions.
Mistake
IAM policies are written in plain English or XML.
Correct
IAM policies are written in JSON format. AWS does not use XML or plain English for policies.
New learners often confuse the format because other cloud providers or older systems use XML. The exam expects you to recognise JSON as the correct policy language.
Mistake
IAM is a regional service, so you must set it up in every region you use.
Correct
IAM is a global service. You configure it once, and it applies to all AWS regions across the world.
Beginners assume that because most AWS services are regional, IAM must also be regional. The exam tests this global nature directly.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. AWS IAM is a free service. You only pay for other AWS services that you grant access to, such as storage or virtual servers.
An IAM user has permanent credentials (password and/or access keys) and is meant for a person or application that needs long-term access. An IAM role has temporary credentials and is used when a service (like an EC2 instance) or a federated user needs short-term access.
You can, but it is against security best practise. The principle of least privilege says you should give only the permissions needed to do the job. Granting full admin access is risky because one compromised user could destroy your entire account.
The explicit deny always wins. Even if another policy says 'Allow', a policy that says 'Deny' will block the action. This is called the deny override.
IAM is a global service. You set it up once, and it works across all AWS regions in the world. You do not need to configure it separately for each region.
You create an IAM role with a policy that allows S3 access, and then you attach that role to the EC2 instance when you launch it (or later via the console). The instance will use temporary credentials from the role to access S3.
You've just covered AWS Identity and Access Management (IAM) — now see how well it sticks with free CLF-C02 practice questions. Full explanations included, no account needed.
Done with this chapter?