AWS IAM Architecture Patterns and Permission Design – SAP-C02 Study Guide

Purpose of This Lesson

AWS IAM architecture questions often present a business requirement and ask you to select the most appropriate permission model. The key decisions include whether permissions belong to a user, group, or role; whether access is human or programmatic; and whether additional policy conditions are required.

This lesson focuses on practical IAM patterns that commonly appear in architecture scenarios and exam questions.

Key Concepts

Grant permissions to groups, not individual users

When multiple IAM users need the same permissions, create an IAM group and attach a permissions policy to the group. Users inherit the permissions assigned to their groups.

For example, if only a selected set of users may change their IAM console passwords:

1. Create a group for the privileged users.
2. Add the appropriate IAM users to the group.
3. Attach a policy granting iam:ChangePassword.

This approach is easier to manage than attaching identical policies separately to each user. Membership in the group becomes the control point for granting or revoking this capability.

The permission to change a user password is separate from the account-level IAM password policy, which controls requirements such as minimum length, character complexity, and password expiration.

Use IAM roles for AWS service access

An Amazon EC2 instance should not receive long-term access keys embedded in its configuration or application code. Instead:

1. Create an IAM role with the required trust policy for EC2.
2. Attach a permissions policy granting only the necessary DynamoDB actions and resources.
3. Associate the role with the EC2 instance through an instance profile.

Applications on the instance can then obtain temporary credentials from the instance metadata service. These credentials are automatically rotated by AWS, reducing the risk associated with stored secrets.

The role’s trust policy determines who or what may assume the role. The permissions policy determines what the assumed role can do. Both parts are required for successful delegated access.

Use AWS managed policies when requirements match a common job function

For a new AWS account and an inexperienced team, AWS managed policies aligned with common job functions can be a practical starting point. Examples include policies intended for administrator, developer, or read-only access.

However, AWS managed policies may grant broader access than a production workload requires. As the organization gains experience, review and replace broad permissions with customer managed policies that follow least privilege and the organization’s governance model.

AWS managed policies can also change as AWS adds new services and actions. That behavior is useful for keeping job-function permissions current, but it means their effective permissions should be reviewed regularly.

Restrict requests by source IP address

An IAM permissions policy can use a Condition element with an IP address condition key such as aws:SourceIp. This can restrict API requests to approved public IP address ranges.

A simplified example is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": [
            "203.0.113.0/24"
          ]
        }
      }
    }
  ]
}

This type of condition evaluates the source IP seen by AWS. It should not be treated as a universal substitute for network controls, private connectivity, MFA, or identity federation. Requests routed through proxies, NAT gateways, VPNs, or other intermediaries may appear to originate from a different address than the user’s endpoint.

Use access keys for programmatic IAM user access, with caution

IAM access keys provide programmatic authentication for tools such as the AWS CLI and SDKs. A developer using an IAM user can configure an access key ID and secret access key for CLI requests.

Access keys are long-term credentials and must be protected carefully:

• Never commit them to source code or public repositories.
• Do not place them in AMIs, container images, or application configuration files.
• Rotate or deactivate them when no longer needed.
• Prefer temporary credentials from IAM roles, AWS IAM Identity Center, or federation where possible.
• Apply least-privilege permissions to the identity using them.

For workloads running on AWS, an IAM role is generally preferable to creating access keys for the workload.

Grant all EC2 API actions with an action wildcard

If a group genuinely requires full access to Amazon EC2 API actions, a policy statement can use:

"Action": "ec2:*"

This grants all actions in the EC2 service namespace allowed by the rest of the policy. It does not automatically grant access to other AWS services, and it does not override explicit denies, permissions boundaries, session policies, or service control policies.

Full service access should be justified because it conflicts with least privilege. Also consider the Resource element and any required conditions rather than assuming that ec2:* alone defines the complete authorization behavior for every EC2 operation.

Exam-Relevant Takeaways

• Use IAM groups to apply common permissions to multiple users.
• The action for changing an IAM user password is iam:ChangePassword.
• Use an IAM role and EC2 instance profile to grant an EC2 instance access to DynamoDB or another AWS service.
• A role’s trust policy controls who can assume it; its permissions policy controls what it can access.
• AWS managed policies are convenient for standard job functions, especially during initial account setup, but may be broader than least-privilege requirements.
• Use policy conditions such as aws:SourceIp to restrict requests by source IP address.
• IAM access keys support AWS CLI and SDK access but are long-term credentials; prefer temporary credentials when possible.
• ec2:* represents all actions in the EC2 service namespace, not every action in AWS.
• An allow statement can still be overridden by an applicable explicit deny.

Architecture Decision Guide

Requirement	Recommended IAM pattern	Important consideration
A selected group of users may change IAM passwords	Add users to a dedicated group with iam:ChangePassword	Manage authorization through group membership and apply the account password policy separately
An EC2 application needs DynamoDB access	EC2 IAM role attached through an instance profile	Use temporary credentials and scope permissions to required tables and actions
A new team needs common job-based permissions	Start with an appropriate AWS managed policy	Review its breadth and replace or supplement it with least-privilege policies as requirements mature
API calls must originate from approved public networks	Add an aws:SourceIp condition to the policy	Account for NAT, proxies, VPNs, and other request path changes
A developer needs CLI access	Use IAM Identity Center, federation, or temporary credentials where possible; access keys only when appropriate	Protect, rotate, monitor, and deactivate long-term keys
A group needs every EC2 API action	Use ec2:* in an appropriate allow statement	This grants only EC2 namespace actions and should be justified by the role

Common Exam Traps

• Confusing a role with a user access key: An EC2 workload should normally use an attached IAM role, not hard-coded IAM user credentials.
• Using a resource policy for every problem: IAM identity policies are appropriate for assigning permissions to users, groups, and roles. Resource policies are an additional authorization mechanism available for supported services.
• Assuming ec2:* means administrator access: The wildcard covers EC2 actions only. It does not grant access to S3, DynamoDB, IAM, or other services.
• Forgetting the trust policy: An EC2 role needs a trust relationship permitting the EC2 service to assume it.
• Treating an IP condition as a complete security solution: Source IP restrictions can be bypassed or affected by network architecture and should complement stronger identity and network controls.
• Selecting AWS managed policies without considering least privilege: They are useful for standard roles but may include permissions beyond the workload’s actual needs.
• Ignoring explicit denies: An explicit deny from an identity policy, resource policy, permissions boundary, session policy, or organization SCP can override an allow.
• Confusing password policy with password-change authorization: Password complexity requirements do not determine which users are allowed to change their passwords.

Real-World Engineer Notes

• Prefer IAM Identity Center and federation for human access across multiple AWS accounts instead of creating large numbers of standalone IAM users.
• Use IAM roles for EC2, Lambda, ECS tasks, and other AWS workloads whenever the service supports them.
• For DynamoDB access, scope permissions to the required table ARN and restrict actions such as read, write, query, or scan according to application needs.
• Monitor access key usage with IAM credential reports, CloudTrail, and security tooling. Remove unused keys rather than leaving them permanently active.
• Test policy changes with IAM Access Analyzer and controlled validation before deploying them broadly.
• Document why a team requires broad permissions such as ec2:*, and establish a review plan to reduce them when possible.
• An IP-based restriction may be unsuitable for mobile users, distributed teams, or access through centralized corporate egress. Identity-based controls and MFA are usually more durable.

Quick Reference Summary

• Group: A collection of IAM users that share permissions.
• Role: An identity that provides temporary credentials to a trusted principal or AWS service.
• Instance profile: The EC2 container used to associate an IAM role with an instance.
• iam:ChangePassword: Permission that allows an IAM user to change their own password when otherwise permitted by policy.
• aws:SourceIp: Global condition key for evaluating the source IP of a request.
• Access key: Long-term credential pair for programmatic access; protect and avoid embedding.
• ec2:*: Wildcard for all actions in the EC2 service namespace.
• Least privilege: Grant only the actions and resources required for the job.

Flashcards

1. Q: What is the preferred way to grant the same IAM permissions to several users?

A: Add the users to an IAM group and attach the policy to the group.

1. Q: Which IAM action allows an IAM user to change a password?

A: iam:ChangePassword.

1. Q: How should an EC2 instance obtain permission to access DynamoDB?

A: Through an IAM role attached to the instance using an instance profile.

1. Q: What is the difference between an IAM role trust policy and permissions policy?

A: The trust policy specifies who may assume the role; the permissions policy specifies what the role may do.

1. Q: Which global condition key can restrict requests by source IP?

A: aws:SourceIp.

1. Q: What does ec2:* mean in an IAM policy?

A: All actions in the EC2 service namespace.

1. Q: Are AWS managed policies always least-privilege policies?

A: No. They are convenient and job-function oriented but can be broader than a specific workload requires.

1. Q: Why are IAM access keys risky for workloads?

A: They are long-term credentials that can be exposed, copied, or forgotten unless carefully managed.

1. Q: What overrides an applicable allow statement?

A: An explicit deny.

1. Q: Does an IAM password policy decide which users may change their passwords?

A: No. It defines password requirements; authorization is controlled through IAM permissions.

Practice Questions

Question 1

An application running on an EC2 instance must read items from one DynamoDB table. The security team prohibits long-term credentials in application configuration. Which solution is most appropriate?

A. Store an IAM user access key in the application configuration
B. Attach an IAM role to the EC2 instance with permission to read the table
C. Add the EC2 instance’s private IP address to an IAM user policy
D. Attach the AmazonDynamoDBFullAccess policy to every developer

Correct answer: B

An EC2 instance should use an IAM role and temporary credentials. The policy should be scoped to the required DynamoDB read actions and table resource. Access keys and broad developer permissions do not meet the stated workload security requirement.

Question 2

A company wants only members of a designated operations team to change their IAM console passwords. What is the simplest maintainable solution?

A. Attach iam:ChangePassword separately to every operations user
B. Create an operations group and attach a policy granting iam:ChangePassword
C. Configure a stricter account password policy
D. Create an EC2 role granting password-change permissions

Correct answer: B

A group centralizes the permission and allows administrators to control access through group membership. A password policy controls password characteristics, not authorization to change a password.

Question 3

An organization permits EC2 read-only API requests only from its corporate public egress range. Which policy feature should be used?

A. An aws:SourceIp condition in an IAM policy
B. An EC2 security group outbound rule only
C. An IAM role trust policy that lists the corporate CIDR
D. An S3 bucket policy

Correct answer: A

The aws:SourceIp condition key can restrict IAM-authorized API requests based on the source IP observed by AWS. Network controls may still be required, and the organization must account for NAT or proxy addresses.

Question 4

A newly created AWS account has a small team that needs standard developer permissions. The team has limited IAM experience, and the requirements match an AWS-defined job function. Which initial approach is most appropriate?

A. Give every user administrator access
B. Create unique inline policies for every user without a review process
C. Use a suitable AWS managed job-function policy and review it for least privilege
D. Create access keys for the root user and distribute them to developers

Correct answer: C

An AWS managed policy aligned with the job function provides a practical starting point. It should be reviewed because managed policies may grant broader permissions than the team’s actual requirements. Root credentials must not be distributed.

Question 5

A group requires complete control of Amazon EC2 APIs but must not automatically receive permissions for other AWS services. Which action specification meets the requirement?

A. Action: "*"
B. Action: "ec2:*"
C. Action: "iam:*"
D. Action: "dynamodb:*"

Correct answer: B

ec2:* allows all actions in the EC2 namespace. * would potentially grant actions across all services and is substantially broader.