Answers

Here are the answers to this chapter’s questions:

1. The two primary access control models are RBAC and ABAC. RBAC regulates access based on predefined roles assigned to users, where each role has a specific set of permissions. In contrast, ABAC uses attributes (associated with users, resources, or the environment) as building blocks in access control decisions, allowing for more granular and dynamic permissions.
2. SCPs in AWS Organizations set permission restrictions for all accounts in an organization. They define the maximum permissions that IAM identities can have. SCPs take precedence over any locally defined IAM policies, meaning if an account has a permissive policy, the SCPs can still restrict it, ensuring centralized control.
3. Role-based cross-account access allows IAM identities in one AWS account to access resources in another account without sharing access keys. The trusting account specifies which external accounts can access its resources, while...