Certified - AWS Certified Cloud Practitioner

One of the most important principles in AWS security is to avoid long-lived credentials. Passwords and access keys that never expire are high-risk targets—if stolen, they can be abused indefinitely. Temporary, scoped credentials are much safer. They exist only for a short period, are automatically rotated, and are tied to a role with limited permissions. This drastically reduces the blast radius of any compromise. For the AWS Certified Cloud Practitioner exam, remember that temporary credentials and federation are preferred over permanent keys because they align with least privilege and modern security practices.
AWS Security Token Service, or STS, is the service that powers temporary credentials. When a user or workload assumes a role, STS issues short-lived credentials consisting of an access key, secret key, and session token. These credentials usually last for minutes or hours and then expire. Applications and users use them just like permanent credentials, but their short lifespan makes them far less risky. On the exam, know that STS provides temporary credentials to support secure, time-limited access.
The AssumeRole process involves two sets of policies: trust and permission. The trust policy defines who is allowed to assume the role—for example, a user in another account or a service like EC2. The permission policy defines what the role can actually do once assumed. Both are required for the flow to work. For example, a Lambda function may assume a role that trusts Lambda as the service, while the permission policy allows access only to a specific DynamoDB table. On the exam, remember that trust controls who can assume the role, and permissions control what they can do.
Session duration is another important detail. Temporary credentials are valid only for a defined time, often ranging from 15 minutes to 12 hours. Short sessions reduce risk because if credentials are compromised, they quickly become useless. Session renewal is done by reissuing credentials, usually after reauthentication. For exam purposes, know that session duration limits exposure and is configurable.
Session policies can further scope down access. Even if a role’s full permissions are broad, an administrator can apply a session policy that narrows what the role can do during a specific session. For example, a contractor might assume a role with administrative permissions, but a session policy allows only read-only access during their temporary job. This adds flexibility and helps enforce least privilege dynamically.
Roles are used differently for workloads and for human users. Workloads, such as EC2 instances or Lambda functions, assume roles to access AWS resources without storing permanent keys. Human users, by contrast, may assume roles through a web login or CLI to perform administrative or operational tasks. For the exam, remember that roles eliminate the need for embedded credentials in applications and also allow humans to gain temporary elevated access.
Identity federation connects external identity systems with AWS. Instead of creating IAM users for every employee, organizations can federate existing accounts from systems like Active Directory, Okta, or Google Workspace. This allows employees to log in with their existing corporate credentials. Federation reduces administrative overhead, supports single sign-on, and aligns with existing governance. On the exam, remember that federation means relying on external identity providers for authentication while AWS handles authorization.
SAML 2.0 is a widely used standard for identity federation. With SAML, a user authenticates to an identity provider like Active Directory Federation Services and then receives a token that allows them to assume roles in AWS. This is common in large enterprises with existing identity infrastructure. On the exam, know that SAML is a federation method that integrates corporate directories with AWS.
OpenID Connect, or OIDC, is another federation standard. OIDC builds on OAuth and is often used with modern applications and cloud-native identity providers. For example, a mobile application could use OIDC to authenticate users through Google or another OIDC provider, then allow them to assume roles in AWS. On the exam, remember that OIDC is a lightweight federation protocol suitable for web and mobile applications.
For mobile and web developers, AWS Cognito provides identity federation in a simple package. Cognito supports both social logins, like Facebook or Google, and enterprise logins via SAML or OIDC. It also provides temporary credentials to access AWS services, integrating neatly with STS. On the exam, remember that Cognito bridges identity for mobile and web apps, providing tokens and temporary credentials.
IAM Identity Center, formerly AWS SSO, fits into this picture by providing centralized single sign-on for AWS accounts and third-party apps. It builds on federation principles, integrating with corporate identity providers and issuing temporary credentials to users across accounts. For exam preparation, know that IAM Identity Center is AWS’s recommended approach for multi-account sign-on and governance.
Session tags extend temporary credentials with additional attributes, supporting attribute-based access control. For example, a user might assume a role with a session tag of “Department: Finance,” which limits them to resources tagged the same way. This adds flexibility and reduces the need for dozens of narrowly scoped roles. On the exam, know that session tags help enforce ABAC with temporary credentials.
Monitoring STS events with CloudTrail is essential. Every AssumeRole or federation event is logged, providing an audit trail of who accessed what and when. Administrators can use these logs to verify least-privilege assumptions and investigate anomalies. For exam purposes, remember that CloudTrail records STS activity, making temporary credentials auditable.
Finally, there are pitfalls to avoid. Hardcoding long-lived access keys in code is dangerous and defeats the purpose of roles. Time drift on servers can cause temporary credential failures, since tokens are time-sensitive. Overbroad roles also create risk, as temporary credentials are only as safe as the permissions they grant. On the exam, expect questions highlighting these pitfalls, with the correct answers pointing toward temporary, scoped, and monitored access.
For more cyber related content and books, please check out cyber author dot me. Also, there are other prepcasts on Cybersecurity and more at Bare Metal Cyber dot com.
Cross-account access is one of the most powerful use cases for temporary credentials. Instead of duplicating IAM users across environments, AWS allows users from one account to assume a role in another. For example, a centralized security team may assume roles into production accounts to audit logs. This arrangement keeps credentials consolidated, improves governance, and reduces sprawl. For the exam, remember that cross-account access is achieved through AssumeRole, not by creating duplicate users.
Federation works best when identity provider attributes are mapped to AWS roles. For instance, a group in Active Directory labeled “Finance” can be mapped to an AWS role with permissions for billing accounts. This way, users’ group memberships automatically translate into the right AWS access. On the exam, know that IdP attributes like groups or tags can map directly into AWS permissions through federation.
Conditional access enhances security by layering restrictions on when and how roles may be assumed. For example, administrators can require multi-factor authentication for sensitive roles or limit access to corporate IP addresses. Device context can also be checked, ensuring that only managed laptops can initiate certain sessions. On the exam, expect to see conditional access tied to MFA or IP restrictions as best practices for secure federation.
Short session durations are another essential best practice. If temporary credentials last only an hour, even if stolen, they expire quickly. Longer sessions provide convenience but increase risk if compromised. For example, a developer role might grant four-hour access, while a highly privileged admin role grants just one hour. On the exam, remember that short-lived sessions reduce the blast radius of credential theft.
Centralized single sign-on across many accounts is supported by IAM Identity Center. With Identity Center, users log in once and gain access to multiple AWS accounts without needing individual IAM users. This aligns with federation by reducing reliance on static accounts and centralizing governance. For the exam, know that centralized SSO simplifies multi-account AWS access.
Automating provisioning and deprovisioning with SCIM helps manage the lifecycle of users. When someone joins, they automatically get placed in the correct groups and assigned roles. When they leave, their AWS access disappears immediately. This prevents orphaned accounts from lingering, which is one of the biggest risks in cloud environments. For the exam, remember that SCIM is used to automate lifecycle events tied to identity providers.
Least privilege must still guide temporary and federated access. Roles should be scoped narrowly, granting only the actions and resources needed. For example, a developer role may allow access only to staging environments, while production access requires explicit approval. On the exam, expect questions where the correct answer emphasizes least-privilege role design, even with temporary credentials.
Session revocation strategies are also important. While temporary sessions expire naturally, sometimes it’s necessary to cut access early. Administrators can shorten session time-to-live values, or change policies so that existing sessions lose permissions. For example, if a role is misconfigured, updating the policy removes permissions even from active sessions. On the exam, remember that session revocation is achieved by shortening TTLs or adjusting policies.
Auditing federated access is critical for visibility. CloudTrail logs show when AssumeRole was used, by whom, and for what actions. Organizations should review these logs regularly to confirm compliance and detect anomalies. For example, if an external contractor assumes a role outside of business hours, that may require investigation. On the exam, remember that CloudTrail is the auditing tool for temporary and federated sessions.
Private access can also be enforced through VPC endpoints. By requiring AWS API calls to go through VPC endpoints, organizations reduce exposure to the public internet. For example, Lambda functions in private subnets can assume roles through STS using private networking. For exam purposes, know that VPC endpoints add an additional layer of security to role assumption workflows.
Governance practices include creating a standard catalog of roles and naming conventions. For example, roles might be named consistently across accounts, such as “AdminRole” or “ReadOnlyRole.” This makes it easier to manage permissions and reduces confusion during audits. On the exam, remember that governance standardization improves clarity in multi-account, federated setups.
From the exam perspective, a key lens is always: prefer roles over access keys. If a question describes IAM users with long-lived credentials embedded in scripts, the best answer is to replace them with roles that provide temporary credentials. Federation and STS-based workflows should always take priority. On the exam, expect several questions testing whether you recognize that roles are the safer alternative.
Finally, secure federation relies on battle-tested practices. These include enforcing MFA, limiting session duration, monitoring with CloudTrail, and scoping permissions narrowly. It also means integrating with corporate identity providers, automating lifecycle events, and reviewing policies regularly. When applied consistently, these practices ensure AWS access is not only secure but also manageable at scale.
As we close this episode, remember the core lesson: federation combined with short-lived STS sessions provides safer, auditable, and more flexible access. Long-lived keys expose organizations to unacceptable risk, while temporary credentials expire naturally, limiting the damage of compromise. For the exam, focus on recognizing the benefits of roles, federation, and short-lived sessions. In practice, adopting these principles lays the foundation for strong identity security in AWS.