ACLOUDGURU Flashcards
Can you log into an IAM group?
How many groups can a user be a part of?
How many members can be in a group?
How many groups can you create per AWS account?
Are groups a true identity?
Can IAM policies or resource policies grant access to an IAM group?
IAM groups don’t have credentials and you cannot log into a group.
IAM user can be a member of 10 groups.
There is no limit to the number of members in a group.
Users by default have no permissions.
There is a soft limit of 300 groups per AWS account but this can be increased by support ticket.
User inherits policies from the group.
Groups are not true identities->groups cannot be referenced in an IAM policy because they don’t have an ARN.
IAM policies or resource policies cannot grant access to an IAM group.
What happens when you restart an EC2 instance vs when you stop and start an EC2 instance?
If an EC2 instance is restarted it remains to the specific host. If AWS stops the EC2 instance and then it is restarted(or if you do) it moves to a different host. They all remain in the same availability zone however.
You can migrate EC2 instances to a different availability zone using snapshots and AMIs
Can you attach an IAM role to a running EC2 instance?
Yes.
What do IAM roles do?
IAM roles allow you to delegate access to users or services that normally don’t have access to your organization’s AWS resources. IAM users or AWS services can assume a role to obtain temporary security credentials that can be used to make AWS API calls. Consequently, you don’t have to share long-term credentials or define permissions for each entity that requires access to a resource.
What are the challenges resolved by Delegated access using IAM roles?
Granting applications that run on Amazon EC2 instances access to AWS resources
To grant applications on an Amazon EC2 instance access to AWS resources, developers might distribute their credentials to each instance. Applications can then use those credentials to access resources such as Amazon S3 buckets or Amazon DynamoDB data. However, distributing long-term credentials to each instance is challenging to manage and a potential security risk. The video above describes how to use roles to address this security concern in more detail.
Cross-account access
To control or manage access to resources, such as isolating a development environment from a production environment, you might have multiple AWS accounts. However, in some cases, users from one account might need to access resources in the other account. For example, a user from the development environment might require access to the production environment to promote an update. Therefore, users must have credentials for each account, but managing multiple credentials for multiple accounts makes identity management difficult. Using an IAM role can simplify this. See the Trend Micro case study to see cross account access in action.
Granting permissions to AWS services
Before AWS services can perform actions for you, you must grant them permissions to do so. You can use IAM roles to grant permissions for AWS services to call other AWS services on your behalf, or create and manage AWS resources for you in your account. AWS services such as Amazon Lex also offer service-linked roles that are predefined and can be assumed only by that specific service.
What is an IAM role?
An IAM role is an IAM entity that defines a set of permissions for making AWS service requests. IAM roles are not associated with a specific user or group. Instead, trusted entities assume roles, such as IAM users, applications, or AWS services such as EC2.
How do I assume an IAM role?
You assume an IAM role by calling the AWS Security Token Service (STS) AssumeRole APIs (in other words, AssumeRole, AssumeRoleWithWebIdentity, and AssumeRoleWithSAML). These APIs return a set of temporary security credentials that applications can then use to sign requests to AWS service APIs.
What problems do IAM roles solve?
IAM roles allow you to delegate access with defined permissions to trusted entities without having to share long-term access keys. You can use IAM roles to delegate access to IAM users managed within your account, to IAM users under a different AWS account, or to an AWS service such as EC2.
How many IAM roles can I assume?
How are IAM roles managed?
You can create and manage IAM roles via the IAM APIs, AWS CLI, or IAM console, which gives you a point-and-click, web-based interface.
What is the difference between an IAM role and an IAM user?
An IAM user has permanent long-term credentials and is used to directly interact with AWS services. An IAM role does not have any credentials and cannot make direct requests to AWS services. IAM roles are meant to be assumed by authorized entities, such as IAM users, applications, or an AWS service such as EC2.
When should I use an IAM user, IAM group, or IAM role?
Can I add an IAM role to an IAM group?
Not at this time.
Q: How many policies can I attach to an IAM role?
For inline policies: You can add as many inline policies as you want to a user, role, or group, but the total aggregate policy size (the sum size of all inline policies) per entity cannot exceed the following limits:
User policy size cannot exceed 2,048 characters.
Role policy size cannot exceed 10,240 characters.
Group policy size cannot exceed 5,120 characters.
For managed policies: You can add up to 10 managed policies to a user, role, or group. The size of each managed policy cannot exceed 6,144 characters.
How many IAM roles can I create?
You are limited to 1,000 IAM roles under your AWS account. If you need more roles, submit the IAM limit increase request form with your use case, and we will consider your request.
What is a shared responsibility?
Encryption
What happens when you don’t give a user permissions manually?
A user by default has zero permissions and can’t access anything.
