Cianplan

Level 4: Reliability, security & cloud · L4.6 AWS architecture decisions (SAA-C03)

IAM and multi-account guardrails

Evaluate an IAM request (explicit deny, allow, implicit deny), and choose roles, resource policies, SCPs and IAM Identity Center for a multi-account design.

13 min · Pro

What you take away

  • Every request starts denied; an explicit deny in any policy wins; otherwise an identity or resource policy has to allow it.

And 3 more inside the class, in Pro.

How the class is laid out

  1. The problem
  2. The simple version
  3. Who is asking
  4. How one request is decided
  5. Many accounts, one set of rules
  6. Check your understanding