Study CLF-C02 Identity, Access and Root-Account Protection: key concepts, common traps, and exam decision cues.
CLF-C02 does not require deep IAM policy writing, but it does expect you to know the safest access habits. Strong answers usually remove long-term credential sprawl, protect the root account, use least privilege, and prefer roles or centralized sign-in over scattered local credentials.
Least privilege: Access model where identities receive only the permissions needed for the current task.
Federation: Using an external identity source to authenticate users instead of creating separate local credentials in each account.
AWS wants you to recognize:
| Term | What it does | Strongest when… |
|---|---|---|
| IAM user | identity for a person or use case that can sign in or use access keys | a basic identity is needed, though often not the strongest long-term pattern |
| IAM role | temporary set of permissions that a user, workload, or service can assume | the requirement is temporary scoped access |
| IAM policy | permission document that allows or denies actions | the question is about what an identity can do |
| IAM group | collection of IAM users with shared permissions | multiple users need a similar permission set |
| IAM Identity Center | centralized workforce access across accounts and apps | the requirement is centralized human sign-in |
The root user has the highest authority in the AWS account. CLF-C02 expects you to know these habits:
If an answer uses the root account for ordinary work, it is usually weak.
| Need | Strongest first fit | Why |
|---|---|---|
| workload on AWS needs access to another AWS service | IAM role | It avoids storing long-term keys on the workload. |
| workforce access across accounts | IAM Identity Center | It centralizes access instead of multiplying usernames and passwords. |
| short-term delegated access | role assumption | The requirement is temporary scoped credentials. |
| secure secret or credential storage | Secrets Manager or Parameter Store | Plain-text config files are weaker. |
If one answer says “store permanent access keys on the instance” and another says “use a role,” the role answer is usually the stronger CLF-C02 choice.
| Trap | Better thinking |
|---|---|
| “The root user is the normal admin account.” | Root is special and should be protected and rarely used. |
| “Long-term access keys are fine if the password is strong.” | AWS prefers temporary credentials and roles where possible. |
| “Least privilege means no one can do anything.” | It means right-sized access, not zero access. |
| “IAM Identity Center and IAM roles solve the same problem.” | Identity Center is for centralized workforce access; roles are the temporary permission vehicle. |
A company wants employees to access multiple AWS accounts without maintaining separate usernames and passwords in each account. Which answer is strongest first?
Correct answer: 3
Why: CLF-C02 prefers centralized sign-in and modern access patterns over repeated account-local credentials or dangerous root-user habits.