Account/Physical Organization

Question 1

Availability Zones work together, across regions, to allow for highly available and fault-tolerant applications.

Answer 1

False. not across region, within a region.

Question 2

High availability

Answer 2

A durable system that can operate for long periods of time without failure.High availability refers to a system that has been tested to be durable and has its components highly or always available to its users.

Question 3

IAM Policies

Answer 3

policies can not be directly attached to AWS resources(such as an EC2 instance).
more than one policy can be attached to a user or group at the same time.

Question 4

How to create a policy?

Answer 4

using policy generator or written from scratch.

Question 5

policy simulator

Answer 5

run test based on the policy you created to make sure policy works.

Question 6

Power user access

Answer 6

Admin access except it does not allow user/group management.

Question 7

Read Only Access

Answer 7

Only view aws resources.

Question 8

IAM User

Answer 8

User credentials should NEVER be stored or “passed” to an EC2 instance.

Question 9

IAM Groups

Answer 9

Allow you to assign IAM permission policies to more than one user at a time.

Question 10

IAM Roles

Answer 10

You can now assign/change a role that is assigned to an RC2 instance after the creation process via the CLI or the EC2 management console.
– an EC2 instance can only have one role attached at a time.

Question 11

IAM Role use case

Answer 11

you are using an EC2 instance and it need to access an S3 bucket.

• • Instance should assume a role from IAM with the proper required permissions.(S3 read only);
• • Instance can then perform actions based on the role it assumes. (read from S3).
• • You “can” but should never pass or store credentials in or to an EC2 instance so roles are used instead.

Question 12

IAM Role Other Users

Answer 12

assume a “role” for temporary access to AWS accounts and resources through having something like Active Directory or single sign-on service assume an “Identity Provider Access” role.
Create “cross account” access where a user from one account can assume a role with permissions in another account.

Question 13

STS

Answer 13

3 components: Session Toke; An Access Key ID; A Secret Access key;

Question 14

When to use STS

Answer 14

Identity Federation; Roles for Cross_account Access; Roles for amazon EC2.

Question 15

STS API Calls

Answer 15

AssumeRole: cross-account delegation and federation through a custom identity broker;
AssumeRoleWithWebIdentity: Federation through a web-based identity provider;
AssumeRoleWIthSAML: Federation Through an ENterprise Identity Provider Compatible with SAML 2.0;
GetFederationToken: Federation Through a Custom Identity Broker;
GetSessionToken: Temproary Credentials for Users in Untrusted Environments.

Question 16

IAM API Keys

Answer 16

required to make programmatic calls to AWS from the:
CLI;
Tools for windows powershell;
AWS SDKs;
Direct HTTP calls using the APIs for individual AWS services;

Question 17

API Access key Facts:

Answer 17

• • only available ONE time when a new user is created OR when you reissue a new set of keys;
• • AWS will NOT regenerate the same set of access keys;
• • API credentials must be associated with a USER;
• • Roles do not have API credentials;
• • In AWS console, you can only see Acess Key ID - never the secret Key ID;
• • If you require new API credentials – you must deactivate the current one and generate new one;
• • never create or store API keys on an EC2 instance.

Question 18

API Access key Facts:

Answer 18

• • only available ONE time when a new user is created OR when you reissue a new set of keys;
• • AWS will NOT regenerate the same set of access keys;
• • API credentials must be associated with a USER;
• • Roles do not have API credentials;
• • In AWS console, you can only see Access Key ID - never the secret Key ID;
• • If you require new API credentials – you must deactivate the current one and generate new one;
• • never create or store API keys on an EC2 instance.