Advanced Identity Flashcards
What is STS?
Security Token Service - grant limited and temporary access to AWS resources
What are the four main API calls to know?
AssumeRole - assume roels within your account or cross account
GetSessionToken - for MFA, from a user or AWS account root user
GetCallerIdentity - return details about the IAM user or role used in the API call
DecodeAuthorizationMessage - decode error message when an AWS API is denied
How do you mandate that MFA is required for an API call?
Add aws:MultiFActorAuthPresent:true as a condition to the IAM policy provided by the GetSessionToken call to STS
How does IAM evaluate whether a policy allows or denies?
Decision starts in the DENY state
-> Evaluate all applicable policies
-> Explicit deny present? Then DENY
-> Then, Explicit allow present? Then ALLOW
-> Else, DENY
How do you work out if an IAM user has access to an AWS resource (e.g., S3)?
Take a UNION of the IAM policy of the user and the S3 bucket policy to get the overall policy
How can you dynamically insert a user’s username into a policy?
${aws:username}
Why are Customer Managed Policies considered best practice, and over what are they preferred?
Preferred over AWS managed and Inline policies
- Best practice as they are versioned, and provide fine grained access
- Inline is specific to the service, lost on service delete
- AWS policies are not fine grained
How can a user allow a service to assume a role and perform actions?
User needs the IAM permission iam:PassRole
-> Allows them to pass the IAM role during setup of that service
Can a role be passed to any service?
No - roles can only be passed to what their ‘trust’ allows
- this is an ‘sts:AssumeRole’ Action for a specified ‘Principal.Service’
What AD would you recommend for:
- Creating your own AD in AWS, manage users locally and supports MFA
AWS managed Microsoft AD
What AD would you recommend for:
- Directory Gateway (proxy) to redirect to on-premises AD, supports MFA
AD Connector
What AD would you recommend for:
- AD compatible managed directory on AWS
Simple AD
