Identity, Access and Application Authorization
Security items test IAM roles, resource policies, Cognito, scoped permissions, cross-service access, temporary credentials, and authorization decisions.
How to study for AWS Developer Associate
Treat each question as an application delivery scenario: identify the service integration, permission boundary, deployment path, and operational signal before choosing an answer.
Core concepts
Concept 1
Identity, Access and Application Authorization questions test AWS developer decisions in code, deployment, security, and operations.
Exam cue: Identify the runtime, integration point, data store, permission boundary, and deployment path in the scenario.
Concept 2
The strongest answer maps the application requirement to the managed AWS service feature that reduces custom code and operational risk.
Exam cue: Choose the AWS service behavior that satisfies the requirement with secure defaults and measurable failure handling.
Concept 3
Eliminate options that expose credentials, bypass least privilege, ignore throttling, or trade observability for convenience.
Exam cue: Prefer managed retries, idempotency, IAM roles, encryption, tracing, and staged release controls when the prompt calls for them.
Risk pitfalls and guardrails
Hard-coding credentials, secrets, or endpoints when AWS provides role-based or managed configuration options.
Guardrail: Avoid answers that hard-code secrets, skip IAM roles, ignore retry behavior, hide failures, or deploy unversioned code directly to production.
Choosing a compute or messaging pattern without considering retry behavior, ordering, idempotency, or concurrency.
Guardrail: Avoid answers that hard-code secrets, skip IAM roles, ignore retry behavior, hide failures, or deploy unversioned code directly to production.
Treating logs, metrics, and traces as afterthoughts instead of exam-tested troubleshooting evidence.
Guardrail: Avoid answers that hard-code secrets, skip IAM roles, ignore retry behavior, hide failures, or deploy unversioned code directly to production.
Memory anchors
IAM Role
An IAM role provides temporary credentials and is preferred for applications and AWS service access.
Least Privilege
Least privilege grants only the actions and resources required for the application task.
Resource Policy
A resource policy grants permissions directly on a supported AWS resource such as S3, Lambda, or KMS.
STS
AWS STS issues temporary security credentials for roles, federation, and delegated access.
Cognito User Pool
A Cognito user pool provides user authentication, tokens, and sign-up or sign-in flows for applications.
Cognito Identity Pool
A Cognito identity pool exchanges identities for temporary AWS credentials.
Lambda Execution Role
A Lambda execution role gives the function permission to call AWS services.
API Authorizer
An API Gateway authorizer controls whether a caller can invoke an API method or route.
Policy Condition
A policy condition limits permission based on request context such as MFA, tags, source IP, or encryption.
Cross Account Access
Cross-account access should use roles and scoped trust instead of long-lived shared credentials.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
An application running on EC2 needs read access to one S3 bucket. The team must avoid distributing long-term AWS credentials to the instances. What should be used?
A container running as an ECS task needs to publish only to one SNS topic. Which credential configuration follows AWS best practice?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”