Advanced IAM Flashcards
What does AWS STS (Security Token Service) do?
It allows you to grant limited and temporary access to AWS resources.
What are the 4 ways to gain access using STS?
- Assume Role
- AssumeRoleWithSAML
- AssumeRoleWithWebIdentity
- GetSessionToken
How long does an AWS token last?
1 hour before requiring refresh
What does AssumeRole do?
Provides access within your own account and cross account access
What does AssumeRoleWithSAML do?
Returns credentials for users logged in with SAML
What does AssumeRoleWithWebIdentity do?
Returns credentials for users logged in with an Id provider like FB, Google etc. You should use Cognito instead of this.
What does GetSessionToken do?
It is for MFA users
What is AWS Directory Services?
A managed Microsoft Active Directory
What is an AD Connector?
A Directory Gateway to redirect to on-premise AD
What is Simple AD?
AD compatible managed directory on AWS that cannot be joined with an on-premise AD
What is an SCP (Service Control Policy)?
It allows you to whitelist/blacklist IAM actions
At what level is the SCP applied?
Its applied at the Organizational Unit (OU) or Account Level
What kind of users does the SCP apply to?
It applies to all users
What are 2 use cases for SCP?
- Restrict Access to certain services
- Enforce compliance by explicitly disabling services
When you see aws:SourceIP in an IAM statement, what does that reference?
The IP or list of IPs that are requested access to resources
