Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson explains the different ways an AWS IAM user can authenticate to AWS services. For the SAP-C02 exam, this matters because identity and access management is foundational to almost every AWS architecture decision.
You need to understand the difference between console access, programmatic access, access keys, MFA, certificates, Git credentials, and service-specific credentials. Scenario questions may test whether you know which authentication method applies to the AWS Management Console, AWS CLI, AWS SDKs, CodeCommit, Amazon Keyspaces, or older certificate-based access patterns.
Key Concepts
IAM User Authentication Overview
An IAM user represents a specific identity inside an AWS account. That user can be configured with different authentication methods depending on how they need to access AWS.
Common IAM authentication methods include:
- Console password
- Multi-factor authentication token
- Access key ID and secret access key
- X.509 signing certificates
- SSH or HTTPS Git credentials
- Amazon Keyspaces credentials
The correct authentication method depends on the access pattern.
AWS Management Console Access
The AWS Management Console is the browser-based graphical interface used to manage AWS resources.
For console access, an IAM user signs in with:
- IAM username
- Password
- Optional MFA token
Example:
A user named John signs in to the AWS Management Console using his IAM username and password. If MFA is configured, he must also provide a second authentication factor.
Once authenticated, the user can perform actions in the console, but only if IAM permissions allow those actions.
Authentication proves who the user is. Authorization determines what the user is allowed to do.
Multi-Factor Authentication
MFA adds an extra layer of protection beyond the password. Instead of relying only on something the user knows, MFA also requires something the user has, such as a virtual MFA app or hardware token.
For SAP-C02, remember that MFA is strongly associated with protecting privileged access, especially:
- Root user access
- Administrator IAM users
- Sensitive operations
- Console sign-in security
MFA does not replace IAM permissions. It strengthens the authentication process.
Programmatic Access with Access Keys
The AWS CLI, AWS SDKs, automation tools, and API-based workflows use programmatic access.
Programmatic access requires an access key pair:
- Access key ID
- Secret access key
The access key ID is similar to a username for API authentication. The secret access key is the private secret used to sign API requests.
Both values are required to authenticate programmatically.
Access keys are associated with an IAM user. When the keys are used, AWS evaluates the permissions assigned to that IAM user through IAM policies.
CLI and API Access
The AWS Command Line Interface and AWS APIs are both programmatic methods of accessing AWS.
Examples include:
- Running AWS CLI commands from an admin workstation
- Using an application to call AWS APIs
- Running scripts that provision AWS resources
- Automating infrastructure management
In all of these cases, the user does not sign in through the browser console. Instead, the request is authenticated through signed API calls using access keys.
Important Security Considerations for Access Keys
Access keys are sensitive credentials. If they are exposed, anyone with those keys may be able to call AWS APIs as that IAM user, depending on the permissions attached.
Real-world concerns include:
- Access keys accidentally committed to Git repositories
- Long-lived keys used by automation scripts
- Overly permissive IAM policies attached to users with keys
- Lack of key rotation
- No monitoring for unusual API activity
For exam scenarios, prefer temporary credentials through IAM roles when possible instead of long-lived IAM user access keys.
X.509 Signing Certificates
IAM also supports signing certificates for certain use cases. These are X.509 certificates used for certificate-based authentication.
The lesson specifically associates signing certificates with older access patterns, such as certain Amazon EC2 SOAP and CLI interfaces.
For SAP-C02 purposes, this is less common than console passwords, MFA, access keys, and IAM roles. However, it is still useful to recognize that signing certificates are another IAM credential type.
SSH and HTTPS Git Credentials
IAM users can also have SSH or HTTPS Git credentials.
These are used for services such as AWS CodeCommit, where a user needs to authenticate to a Git repository hosted in AWS.
Instead of using the AWS Management Console password or normal AWS access keys directly, CodeCommit can use Git-specific credentials.
Use this authentication method when the access pattern is Git-based repository access.
Amazon Keyspaces Credentials
Amazon Keyspaces is AWS’s managed Apache Cassandra-compatible database service.
IAM users can be configured with credentials specifically for Amazon Keyspaces access. This allows applications or users to authenticate to Amazon Keyspaces using service-specific credentials.
This is another example of AWS having different credential types for different service access patterns.
IAM Credentials Are Configured on the User Account
The different authentication methods are configurable from the IAM user account.
An IAM user may have one or more credential types depending on what they need to access.
For example:
- A helpdesk admin may only need console access with MFA.
- A developer may need CodeCommit Git credentials.
- A script may use access keys for CLI/API access.
- A legacy workflow may require signing certificates.
- An application connecting to Amazon Keyspaces may need Keyspaces credentials.
The design goal is to give the user only the credential types they actually need.
Authentication vs Authorization
This is one of the most important concepts.
Authentication answers:
“Who are you?”
Authorization answers:
“What are you allowed to do?”
A user may successfully authenticate to AWS but still be unable to perform certain actions if IAM policies do not allow those actions.
For example, an IAM user can successfully sign in to the AWS Management Console but still be denied access to create an EC2 instance if their IAM policy does not allow ec2:RunInstances.
Exam-Relevant Takeaways
For the SAP-C02 exam, remember these points:
- Console access uses a username and password.
- MFA can be added to strengthen console authentication.
- CLI, SDK, and API access use access keys.
- An access key consists of an access key ID and secret access key.
- Access keys are associated with IAM users.
- Access keys provide programmatic access, not console access.
- IAM authentication does not automatically grant permissions.
- IAM policies still control what authenticated users can do.
- Git credentials are used for CodeCommit access.
- Amazon Keyspaces has service-specific credentials.
- Signing certificates are an IAM credential type, but they are less common in modern AWS architectures.
- In real-world and exam scenarios, long-lived access keys should be avoided when temporary role-based credentials are available.
Architecture Decision Guide
| Scenario | Best AWS Choice | Why |
|---|---|---|
| User needs browser-based access to AWS | IAM user console password with MFA | Console access requires username/password, and MFA improves security |
| User needs to run AWS CLI commands | Access key ID and secret access key | CLI access is programmatic and uses signed API requests |
| Application needs to call AWS APIs | Programmatic credentials or preferably an IAM role | Applications access AWS through APIs; roles are preferred when supported |
| Developer needs Git access to AWS CodeCommit | SSH or HTTPS Git credentials | CodeCommit supports Git-specific authentication methods |
| User needs access to Amazon Keyspaces | Amazon Keyspaces credentials | Keyspaces supports service-specific credentials |
| Legacy certificate-based workflow requires authentication | X.509 signing certificate | Signing certificates support specific older access methods |
| Highly privileged administrator needs console access | Console password plus MFA | MFA helps protect sensitive administrative access |
| Automation running on AWS compute needs AWS API access | IAM role instead of long-lived IAM user keys | Temporary role credentials reduce key exposure risk |
Common Exam Traps
Trap 1: Confusing Console Access with Programmatic Access
A username and password are for AWS Management Console access.
Access keys are for programmatic access through the AWS CLI, SDKs, and APIs.
If an exam question mentions scripts, SDKs, automation, or API calls, think access keys or IAM roles — not console passwords.
Trap 2: Thinking Authentication Equals Permission
Signing in successfully does not mean the user can perform all actions.
The user still needs IAM permissions.
An IAM user can authenticate successfully and still receive an access denied error.
Trap 3: Treating Access Keys Like Normal Passwords
Access keys are not used to log in to the AWS Management Console. They are used to sign API requests.
The access key ID and secret access key work together. The secret access key must be protected like a password.
Trap 4: Forgetting MFA Is Optional but Strongly Recommended
MFA is not automatically enabled for every IAM user. It must be configured.
On the exam, MFA is usually the right answer when the scenario involves improving sign-in security for privileged users.
Trap 5: Using IAM User Keys When a Role Would Be Better
Access keys are valid for programmatic access, but in many architecture scenarios, IAM roles are the better design.
For example, an EC2 instance that needs to access S3 should usually use an IAM role, not hardcoded IAM user access keys.
Trap 6: Ignoring Service-Specific Credentials
Some AWS services use specialized credential types. CodeCommit can use Git credentials. Amazon Keyspaces can use Keyspaces credentials.
Do not assume every service uses only the console password or standard access keys.
Real-World Engineer Notes
In production environments, IAM credential design has major security and operational impact.
Console access should be limited and protected with MFA, especially for administrative users. Access keys should be treated as sensitive secrets and should not be stored in scripts, plaintext files, shared folders, or source code repositories.
For infrastructure engineers, one of the most important design patterns is to avoid static credentials wherever possible. If a workload runs on AWS, use IAM roles and temporary credentials. Examples include EC2 instance profiles, Lambda execution roles, ECS task roles, and EKS IAM roles for service accounts.
Access keys may still be needed for certain external systems, third-party tools, or legacy workflows. When they are used, they should be tightly scoped, rotated, monitored, and protected.
In troubleshooting scenarios, always separate authentication from authorization:
- Authentication problem: The user or application cannot sign in or authenticate.
- Authorization problem: The user or application authenticates successfully but receives
AccessDenied.
This distinction helps narrow down whether you are dealing with credential issues, IAM policy issues, SCP restrictions, resource policies, trust policies, or service-specific permissions.
Quick Reference Summary
IAM supports multiple authentication methods depending on the access type.
Console users authenticate with a username and password, optionally protected by MFA. Programmatic users authenticate with an access key ID and secret access key. Git-based access to CodeCommit can use SSH or HTTPS Git credentials. Amazon Keyspaces has its own service-specific credentials. X.509 signing certificates exist for certain certificate-based access scenarios.
For the SAP-C02 exam, remember that authentication only identifies the principal. IAM policies and other authorization controls determine what that principal can actually do.
Flashcards
Q: What credentials are used for AWS Management Console access?
A: An IAM username and password, optionally protected by MFA.
Q: What are the two parts of an AWS access key?
A: The access key ID and the secret access key.
Q: What type of access do access keys provide?
A: Programmatic access through the AWS CLI, SDKs, and APIs.
Q: Are access keys used to sign in to the AWS Management Console?
A: No. Console access uses a username and password. Access keys are for programmatic access.
Q: What does MFA add to IAM authentication?
A: A second factor of authentication, improving protection beyond just a password.
Q: Does successful authentication automatically grant permission to perform AWS actions?
A: No. IAM policies still determine authorization.
Q: What AWS service commonly uses SSH or HTTPS Git credentials?
A: AWS CodeCommit.
Q: What type of credentials can be used for Amazon Keyspaces?
A: Amazon Keyspaces service-specific credentials.
Q: What is an X.509 signing certificate used for in IAM?
A: Certificate-based authentication for certain AWS service interfaces, such as older EC2 SOAP/CLI access patterns.
Q: In modern AWS architecture, what is usually preferred over long-lived IAM user access keys for workloads?
A: IAM roles with temporary credentials.
Q: What is the difference between authentication and authorization?
A: Authentication verifies identity; authorization determines what actions are allowed.
Q: Why are exposed access keys dangerous?
A: They can allow unauthorized API access using the permissions of the associated IAM user.
Practice Questions
Question 1:
A developer needs to run AWS CLI commands from a workstation to manage AWS resources. Which IAM credential type is required for this programmatic access?
A. IAM username and password
B. Access key ID and secret access key
C. MFA token only
D. AWS Management Console password only
Correct Answer:
B. Access key ID and secret access key
Explanation:
The AWS CLI uses programmatic access through signed API requests. This requires an access key ID and secret access key, unless temporary role-based credentials are being used.
Question 2:
An IAM user successfully signs in to the AWS Management Console but receives an access denied error when trying to create an EC2 instance. What is the most likely issue?
A. The user failed authentication
B. The user needs an access key
C. The user does not have the required IAM permissions
D. The user must use Git credentials
Correct Answer:
C. The user does not have the required IAM permissions
Explanation:
The user authenticated successfully by signing in. The access denied error indicates an authorization problem, meaning the user’s IAM permissions do not allow the requested action.
Question 3:
A company wants to improve the security of administrator sign-ins to the AWS Management Console. Which option is most appropriate?
A. Create CodeCommit Git credentials
B. Enable MFA for administrator IAM users
C. Generate Amazon Keyspaces credentials
D. Create an X.509 signing certificate
Correct Answer:
B. Enable MFA for administrator IAM users
Explanation:
MFA strengthens console authentication by requiring a second factor in addition to the IAM username and password.
Question 4:
A developer needs to authenticate to an AWS-hosted Git repository in CodeCommit. Which credential type is most relevant?
A. SSH or HTTPS Git credentials
B. Amazon Keyspaces credentials
C. Root account password
D. X.509 signing certificate
Correct Answer:
A. SSH or HTTPS Git credentials
Explanation:
AWS CodeCommit supports Git-based authentication using SSH or HTTPS Git credentials.
Question 5:
Which statement best describes the relationship between IAM authentication and IAM authorization?
A. Authentication grants all permissions by default
B. Authorization happens before the user is identified
C. Authentication verifies identity, while authorization determines allowed actions
D. MFA replaces the need for IAM policies
Correct Answer:
C. Authentication verifies identity, while authorization determines allowed actions
Explanation:
Authentication confirms who the principal is. Authorization determines what that principal is allowed to do based on IAM policies and other applicable controls.