A Cantrill - IAM, ACCOUNTS AND AWS ORGANISATIONS Flashcards
What is the order of priority for IAM permissions? (who can access what?)
- Explicit DENY
- Explicit ALLOW
- Default DENY (Implicit)
What IAM policy method is best practice? Managed or Inline Policy?
Managed policy is best practice
What is a principal in IAM?
A person, service account or application
What are the limits for number of IAM users per account?
What is the limit for number of groups that 1 User can be a part of?
-5,000 IAM users per account
-IAM user can be a member of 10 groups
What is the best IAM strategy for very large organizations or “Internet scale applications”?
IAM Roles (not users) & Identity Federation
What is the limit of groups in an account?
300 groups
T or F: Groups are NOT a true identity. They CANNOT be referenced as a principal in a policy
True
What are the two types of policies that can be attached to a IAM Role?
Trust Policy and Permissions policy
What are the two types of policies that can be attached to a IAM User?
Inline policy and Managed policy
In AWS organization, what are the types of accounts?
Management account (aka payer account), Member accounts,
What is CloudTrail?
Logs API calls and account events.
It’s very often used to diagnose security or performance issues, or to provide quality account level traceability.
How long are CloudTrail Events stored by default?
CloudTrail events are stored 90 days by default
Where are Global services (IAM, STS, CloudFront) CloudTrail located?
US-East-1
What are the two types of Cloudtrail events? And which one is NOT enabled by default?
Management and Data events.
Data events are NOT enabled by default
-What is the feature of CloudTrail that allows you to store Events in a place other than CloudTrail Events ?
-And where can you store these Events?
-CloudWatch Trails
-S3 and CloudWatch Logs.
Is CloudTrail a good use case for “realtime” events?
No CloudTrail is NOT a realtime service
What is the typical delivery time of CloudTrail events?
Typically 15 minutes
What is AWS Control Tower?
Ability to set up and govern Multi-Account environment that prescribes best practices.
Orchestrates several other AWS services such as Organizations, Service Catalog, and AWS IAM Identity Center, Cloud Formation, Config, etc.
What is the multi-account environment in AWS Control Tower?
Landing Zone.
What is a feature in Control Tower that can detect/mandate rules and standards across all accounts?
AWS Guard Rails.
What are the three levels of Control Tower Guard Rails?
Mandatory, Strongly Suggested, Elective.
What are the two services that Guard Rails uses that to make its rules?
AWS ORG SCPs - Preventative (stops you from doing things)
AWS Config - Detective (compliance checks)
What is Account Factory?
Allows a user to create accounts but has guard rails and limits
What account type is unaffected by SCPs?
Management account in AWS organizations.
