SCS-C03 Identity and Access Management Guide

IAM is the heaviest SCS-C03 domain because identity failures break everything else. AWS is not only testing whether you recognize IAM terms. It is testing whether you can separate authentication from authorization, temporary credentials from long-term credentials, and identity policy from trust, boundary, session, SCP, and resource-policy behavior.

What AWS is explicitly testing

As of May 11, 2026, the current AWS Documentation exam guide splits this domain into two tasks:

• Task 4.1: design, implement, and troubleshoot authentication strategies
• Task 4.2: design, implement, and troubleshoot authorization strategies

That is a useful exam habit by itself. If a question is really about who can sign in or obtain credentials, it is usually an authentication problem. If it is about what that principal is allowed to do after sign-in, it is usually an authorization problem.

Current weight in the exam guide

AWS currently weights this domain at 20% of scored content, making IAM the single largest SCS-C03 area.

Work this domain in order

Start with 4.1 Authentication Strategies to lock down federation, IAM Identity Center, STS, temporary credentials, Cognito, and sign-in troubleshooting.

Then move to 4.2 Authorization Strategies to handle IAM policies, resource policies, trust policies, SCPs, permission boundaries, session policies, ABAC, and Access Analyzer.

Fast routing inside this chapter

What strong SCS-C03 answers usually do

• prefer temporary credentials over long-lived credentials
• push workforce access toward federation and IAM Identity Center instead of account-local IAM users
• separate authentication, trust, and authorization into different evaluation steps
• check policy-intersection and explicit-deny behavior before changing the wrong control
• use higher-level guardrails such as SCPs when the requirement is organization-wide prevention

Common IAM traps on SCS-C03

• fixing an authorization problem with another login method
• reading one Allow statement and ignoring SCPs, permission boundaries, session policies, or resource policies
• using Cognito for workforce AWS account access when IAM Identity Center is the better fit
• sharing long-term keys when AssumeRole or another temporary-credential path is available
• forgetting that KMS key policy can still block access even when IAM looks correct

Best review order late in prep

Revisit this chapter when:

• you keep missing questions with multiple overlapping policy layers
• you confuse authentication failure with authorization failure
• cross-account access questions still feel slippery
• you know the IAM terms but still choose the wrong control layer

In this section

• SCS-C03 Authentication Strategies Guide
  Study SCS-C03 authentication strategies for federation, IAM Identity Center, STS, Cognito, MFA, and troubleshooting.
• SCS-C03 Authorization Strategies Guide
  Study SCS-C03 authorization strategies for IAM policies, ABAC, resource policies, SCPs, boundaries, and troubleshooting.