AWS IAM Policies and Cross-Account Access: Exam-Critical Patterns

What is this page about?

A deep dive into AWS IAM policies and cross-account access, the highest-weighted security topic on the architect-track exams (30% of the SAA-C03 security domain, over half of the Security Specialty). It explains the IAM mental model, the six-step policy evaluation logic, identity-based versus resource-based policies and when each wins, the cross-account assume-role pattern and the confused-deputy problem, permission boundaries, Organizations and service-control policies, federated access, and the specific STS operations and scenario patterns exam writers reach for.

What has been corrected on this page?

Every accepted correction to this page is recorded with the exact change, so readers can see how the page improved over time.

1. 11 July 2026 · corrected by Melik Can Sariyer

   2 originally flagged claims plus 1 additional unverified Stephane Maarek quote found in the same file while correcting the others. Becky Weiss is a real AWS Senior Principal Engineer who has genuinely worked on IAM, but this specific quote is unverifiable and the article's own reference section reportedly ties it to an unrelated re:Inforce topic (IAM Access Analyzer) -- de-attributed. The Capital One/Netflix/Salesforce 'publicly described' claim has no findable source -- softened to a general industry-practice statement. The second Maarek quote follows the same confirmed-unverified pattern found twice already this session.

   Before

   Unverified quotes attributed to Becky Weiss (Senior Principal Engineer at AWS) and Stephane Maarek. Unsourced "publicly described" claim about Capital One, Netflix, and Salesforce all using cross-account role isolation.

   After

   De-attributed both the Becky Weiss and Stephane Maarek quotes to plain prose. Softened the Capital One/Netflix/Salesforce claim to a general statement about common enterprise practice among large AWS customers running multi-account setups under AWS Organizations.

   Why: Applied fact-check fix: de-attributed 2 unverified quotes and generalized an unverifiable named-companies claim.

   View the full record →

Who checked this page?

1 contributor has checked "AWS IAM Policies and Cross-Account Access: Exam-Critical Patterns" on Pass4Sure. Each name below links to that person's public CitePep profile, where every contribution they have made is listed with the exact change they proposed.