What You'll Be Tested On
- Implement least-privilege access with IAM policies and permission boundaries
- Design cross-account access patterns with IAM roles and resource policies
- Implement identity federation (SAML, OIDC, IAM Identity Center)
- Configure Cognito for application authentication and authorization
- Analyze and remediate overly permissive access with Access Analyzer
Key AWS Services in This Domain
Exam Tips for Domain 4
Know IAM policy evaluation logic: explicit deny → SCP → permission boundary → identity policy → resource policy
Understand the difference between identity-based and resource-based policies
Practice designing cross-account access for common scenarios
Practice Domain 4 Questions
Test your knowledge of Identity & Access Management with practice questions from our SCS-C02 question bank.
Start Practice Quiz →