Security / IAM

10 AWS Security / IAM terms and services covered in certification exams, with exam-focused explanations.

AWS IAM

The foundational access control service managing who (authentication) can do what (authorization) on which AWS resources — composed of users, groups, roles, and policies. Least-privilege principle, root user protection, and MFA are tested at every exam level.

IAMロール

A set of temporary permissions that users or services can 'assume' (AssumeRole). Grants EC2 and Lambda instances safe access to AWS APIs without embedding long-term access keys. Avoiding hardcoded access keys by using roles is one of the most frequently correct answers across all exams.

IAMポリシー

A JSON document defining allow or deny rules for specific API actions. Composed of Effect, Action, Resource, and Condition elements. The evaluation logic (explicit Deny always wins; no Allow = implicit deny) and least-privilege design are tested in scenario questions.

AWS KMS

A key management service for centrally creating and managing encryption keys. Integrates with S3, EBS, RDS, and many other services for at-rest encryption. Tested in contexts of key rotation, access control, and audit logging via CloudTrail.

AWS Secrets Manager

A service for securely storing and retrieving secrets such as database passwords and API keys, with automatic credential rotation. Prevents plaintext credentials in code. The correct answer for 'secure secret storage without hardcoding.'

AWS WAF

A Web Application Firewall that protects against attacks like SQL injection and cross-site scripting. Works with CloudFront, ALB, and API Gateway. Tested as the Layer 7 (application layer) defense mechanism, contrasted with Shield (Layer 3/4 DDoS protection).

AWS Shield

A DDoS protection service. Standard (free) provides automatic protection against common attacks; Advanced (paid) adds enhanced protection and expert support. Contrasted with WAF (application-layer attack defense) as the Layer 3/4 DDoS mitigation service.

Amazon Cognito

A service for adding user sign-up and sign-in to web and mobile apps. Consists of User Pools (user management/authentication) and Identity Pools (temporary AWS credentials). The answer for app user authentication and external identity provider (IdP) federation.

Amazon GuardDuty

A security monitoring service that uses machine learning to analyze logs (CloudTrail, VPC Flow Logs, DNS) and automatically detect threats. No agent installation required. The answer for automated continuous threat detection requirements.

AWS Organizations / SCP

AWS Organizations manages multiple accounts centrally with consolidated billing and OU-based structure. SCPs (Service Control Policies) define the maximum allowed operations (guardrails) for accounts in the organization. Frequently tested in cross-account governance and cost consolidation scenarios.

Last updated: 2026-06-24

This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.