The Big Picture

🔐

AWS Identity and Access Management

Before any action happens in AWS — creating a server, reading a file, sending a message — IAM decides whether it's allowed.

~75 min total10 modules10 quiz questionsDOP-C02 High priority

What IAM does

Every time you click in the AWS Console, run a CLI command, or a Lambda function calls an AWS API — that request goes through IAM first. IAM asks three questions:

👤

Authentication

Who are you?

Prove identity via password, access key, or temporary token

📋

Authorization

What can you do?

Check attached policies for an explicit Allow or Deny

🎯

Resource scope

On what?

The permission targets specific resources, not everything

The most important rule

DEFAULT = DENY

Every API call starts as denied. You explicitly open what's needed — not close what isn't.

IAM starts from "no access". If there's no explicit Allow for an action, it's blocked — this is called an implicit deny. You must actively grant permissions, not actively revoke them.

💡The bouncer analogy: IAM is a nightclub with a guest list AND a banned list. Not on the guest list = you're out (implicit deny). On the banned list = still out, even if you're also a guest (explicit deny). The banned list always wins over the guest list.

Why this matters for the exam

IAM appears in nearly every DOP-C02 question — even CodeDeploy, ECS, and Lambda questions are often IAM questions in disguise. Master IAM and you'll immediately recognise the access control angle in any scenario.

"No credentials in code"→ IAM role

"Cross-account access"→ AssumeRole or resource-based policy

"Least privilege"→ specific actions + specific resources

"Members cannot delete Config rules"→ SCP

"Lambda can't write to S3"→ missing or wrong execution role

"Temporary credentials"→ STS / role assumption