Several IAM principals need a reusable permission set, while another workload needs organization-specific actions and resources.
The team is comparing policy management models.
Choose TWO correct statements about IAM policies.
AWS managed policies are maintained by AWS, while customer managed policies are created and maintained by the customer; both should be scoped to need.
Detailed explanation
The customer owns the policy lifecycle and can tailor permissions to organizational requirements.
The customer owns the policy lifecycle and can tailor permissions to organizational requirements.
IAM policies define permissions; secret storage is handled by services such as Secrets Manager.
IAM policies define permissions; secret storage is handled by services such as Secrets Manager.
AWS creates and maintains these reusable policies; customers attach them where appropriate.
AWS creates and maintains these reusable policies; customers attach them where appropriate.
Resource and condition scoping are important controls for least-privilege design.
Resource and condition scoping are important controls for least-privilege design.
Check official documentation
Compare the following points with the official documentation.
IAM User GuideのPolicies and permissionsとmanaged policyの説明を確認する。
What to confirm
AWS管理ポリシーと利用者管理ポリシーの違いを説明でき、権限範囲を最小限に設計できる。
Key points
- AWS managed policy
- Customer managed policy
- Resource
- Least privilege
Notes
- Environment: AWS公式IAMドキュメントの確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Policy ownership
Managed-policy ownership determines who controls updates and the policy lifecycle.
Scope controls
Action, Resource, and Condition elements can express a narrow permission set.