Security World 1 · Who Can Do What · Stage 3

Tag Says So

Three teams, one statement: the tag on the principal must match the tag on the resource, and a missing key is a no.

Domain: Security
World: Security World 1: Who Can Do What (Associate)
Game type: Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time: About 25 minutes on a first attempt (estimated)
Exam guides: SAA-C03Task 1.1: Design secure access to AWS resources
SOA-C03Skill 4.1.3: Implement multi-account strategies securely (for example, AWS Organizations, service control policies, IAM Identity Center)
SCS-C03Skill 4.2.2: Design attribute-based access control (ABAC) and role-based access control (RBAC) strategies (for example, by configuring resource access based on tags or attributes); Skill 4.2.3: Design, interpret, and implement IAM policies by following the principle of least privilege (for example, permission boundaries, session policies)
MLA-C02Skill 4.3.3: Configure IAM policies and roles for users and applications in ML and AI systems
AIP-C01Skill 2.1.3: Develop safeguarded AI workflows to ensure controlled FM behavior (for example, by using Step Functions to implement stopping conditions, Lambda functions to implement timeout mechanisms, IAM policies to enforce resource boundaries, circuit breakers to mitigate failures)