Security World 1 · Who Can Do What · Stage 4

Inside the Boundary

A boundary never grants, a session policy only subtracts, and PassRole is how a developer borrows production's power.

Domain: Security
World: Security World 1: Who Can Do What (Associate)
Game type: Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time: About 25 minutes on a first attempt (estimated)
Exam guides: DEA-C01Skill 4.2.6: Construct custom policies that meet the principle of least privilege
SAP-C02Task 1.2: Prescribe security controls
SCS-C03Skill 4.2.3: Design, interpret, and implement IAM policies by following the principle of least privilege (for example, permission boundaries, session policies); Skill 4.2.5: Investigate and correct unintended permissions, authorizations, or privileges granted to a resource, service, or entity (for example, IAM Access Analyzer)
AIP-C01Skill 2.1.3: Develop safeguarded AI workflows to ensure controlled FM behavior (for example, by using Step Functions to implement stopping conditions, Lambda functions to implement timeout mechanisms, IAM policies to enforce resource boundaries, circuit breakers to mitigate failures)