Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Adrian C - AWS Pro Arch > Advanced Permissions and Accounts > Flashcards

Advanced Permissions and Accounts Flashcards

1
Q

STS generates these when the sts:AssumeRole API call is made

A

Temporary credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

STS credentials are similar to secret/access keys except for these 2 thigns

A

Don’t below to the identity that assumes the role (unlike IAM user)

Temporay (they expire)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The trust policy on a role defines this

A

Who is allowed to assume the role

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The permissions policy on a role defines this

A

The AWS services and actions the role gives access to

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

STS creds includ these 4 items

A

AccessKeyId -unique identifier

Expiration

SecretAccessKey - Used to sign requests

Session Token - unique token that must come along with all requests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

sts:AssumeRole* calls are made by existing identities of either one of these two types

A

AWS Identity

External(Federation) Identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Are roles meant to have complex logic determining who gets what set of permissions?

A

No, a role gives a set of permissions to anyone who is enabled to assume in the trust policy. Different set of permissions implies a different role is needed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

If you knew of a crediential leak for a role, why wouldn’t you remove all permissions of that role or just delete the role outright?

A

There may be other users who assume the role that still need the access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

If you knew of a credential leak for a role, why would you not change the trust policy for the role to limit the access?

A

The malicous user already has valid credentials (Access key, secret key, token) to assume the role. In essence, the cat is already out of the bag.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can you manually invalidate temporary credentials like roles?

A

No, but you can update the role permissions policy with an inline DENY of AWSRevokeOlderSessions for any sessions older than now. Valid users will be forced to re authenticate, bad actor will be SOL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When does the session token come into play for AWS creds?

A

Any temporary credentials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

First step in interpreting a policy doc?

A

Identify the number of Statement block {Effect:…..}

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What implicit permissions exist if nothing is defined?

A

Nothing. Said another way, implicit deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What always takes precident in AWS?

A

Deny permission

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

When looking a Resource in a policy statement detailing with S3, what does /* represent?

A

Sub-objects, not the bucket itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Why is it unlikely that you will find a policy with only a deny statement?

A

By default, everything is denied anway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What S3 actions require a * resource?

A

ListAllMyBuckets

GetBucketLocation

CreateBucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Only these types of permissions are impacted by Permissions Boundaries

A

Identity permissions (any resource policies are applied in full)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Permissions Boundaries can only be applied to these two things

A

IAM Users

IAM Roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Do permissions boundaries grant access on their own?

A

No, they define maximum permissions an identity can have.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Common Variables to use in IAM

A

aws: CurrentTime This can be used for conditions that check the date and time.
aws: EpochTime This is the date in epoch or Unix time, for use with date/time conditions.
aws: TokenIssueTime This is the date and time that temporary security credentials were issued and can be used with date/time conditions. Note: This key is only available in requests that are signed using temporary security credentials. For more information about temporary security credentials, see Temporary security credentials in IAM.
aws: PrincipalType This value indicates whether the principal is an account, user, federated, or assumed role—see the explanation that follows later.
aws: SecureTransport This is a Boolean value that represents whether the request was sent using SSL.
aws: SourceIp This is the requester’s IP address, for use with IP address conditions. Refer to IP address condition operators for information about when SourceIp is valid and when you should use a VPC-specific key instead.
aws: UserAgent This value is a string that contains information about the requester’s client application. This string is generated by the client and can be unreliable. You can only use this context key from the AWS CLI.
aws: userid This value is the unique ID for the current user—see the chart that follows.
aws: username This is a string containing the friendly name of the current user—see the chart that follows.
ec2: SourceInstanceARN This is the Amazon Resource Name (ARN) of the Amazon EC2 instance from which the request is made. This key is present only when the request comes from an Amazon EC2 instance using an IAM role associated with an EC2 instance profile.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What to things have to happen for an entity in Account A to access something in Account B?

A

Account A has to allow the access out, account B has to allow the access to the resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

If an SCP is in place, what happens if an incoming action is not allowed?

A

Implicitly denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Six checkpoints of resource access

A

Explict Deny

SCPs

Resource Policies (if access granted here, stop processing)

Permission Boundaries

Session Policies (for IAM Roles)

Identity Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is the S3 Canonical ID?
Legacy ID used in ACLs
26
What level do you define in the trust relationship of a role?
The account level that you will permit to use the role.
27
There levels of an AWS Org that SCPs can be attached to
Root level of the org (entire) 1 to many OUs Individual account level
28
IN an AWS organization, how to you apply an SCP so it impacts the root AWS account/management account?
You cannot. It is special.
29
Do SCPs grant permissions?
No, they are account level permissions boundaries. They limit what can be done in an AWS account, not grant access.
30
Can you limit what the root account in an AWS account can do?
Not exactly, but you can use SCP's to limit what can be done in an AWS account, inherintly limiting what the root account can do.
31
What is the default SCP setting when enabled?
Allow \*. If you didn't do this, the default implicit deny would apply at the SCP level, and there would be no access.
32
From an SCP perspective, how do you 1) implement a deny list approach 2)implement an allow list approach and 3) why
1) Keep the default allow \*, use deny statements for services you want to block 2) Remove the default allow, add allow statements for services you want 3) 1 is easier admin overhead
33
Can you apply an S3 ACL to multiple objects?
No, each object needs an ACL (no inheritance)
34
In S3, who becomes the object owner of an S3 object?
The source account of the thing uploading the object
35
Using ACLs and S3 in a cross account scenario does the destination account get access by default to the object uploaded by the souce?
No, this is a limitation of ACLs. Destination bucket account will only have access if the source entity granted access.
36
Why might you choose to use Cross Account Roles when granting an external party access to store objects in S3?
That way the object owner of the S3 objects will be your account.
37
Regarding a trust policy in an IAM Role, do you put in a user or the root AWS account user of who will be assuming?
Root: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::639767416172:root" }, "Action": "sts:AssumeRole" } ] }
38
RAM, or Resource Access Manager, allows for sharing of AWS assets between other AWS Principles. What three types of things fall into the principles definition?
Accounts, OUs, and Orgs.
39
What is the per hour charge for RAM?
Nothing, it is free, aside from the cost of the service you are using.
40
While availability zone names are not consistent across different accounts, what identified is?
AZ IDs (use1-az1, use1-az2, etc)
41
Once an asset is shared with RAM, which entities have full control?
Only the owner
42
Is RAM bi?
No, the owner creates and names the share.
43
If a priniciple is inside an ORG with sharing enabled, this is the default behavior for accesses shared by RAM
auto accept
44
For non org account, or for AWS orgs where sharing is not enabled, this is the default behavior for RAM invites
Have to be accepted by the priniciple of the destination
45
If a VPC is shared with RAM to another member account (participant), can you refenence security groups and see network assets (subnets, VPCs)?
Yes, can't change network layer tho. And if the owner was to provision EC2 instances in the shared subnet, participant account wouldn't see EC2 instances.
46
If you provision an EC2 instance into a subnet that is shared with you via RAM, who is the owner of those assets?
The provisioning account retains ownership
47
SCP inherit…
down the chain
48
Name a service level quota that can't be changed
IAM (5000 users)
49
Each AWS service have this per region
quota
50
Service Quota Dashboard
sweeet interface in the console giving visibility, can also request quota increases here. Can also create CloudWatch alarms from here! Service Quota console is preferred over legacy support ticket. CLI is also available. Can also set up Org template that will get submitted for new accounts.
51
What is one cavaet to object owernship using S3 ACls?
There is a setting on the bucket that can be used to say everything created in the bucket with an ACL is owned by the account, or can allow other accounts to own. If you allow other accounts to own, you can choose between bucket owner owned or Object Writer owned.
52
Do SCPs apply to external accounts?
SCPs affect only IAM users and roles that are managed by accounts that are part of the organization. SCPs don't affect resource-based policies directly. They also don't affect users or roles from accounts outside the organization.
53
Cognito provides these three things for web/mobile apps
Authentication Authorization User management
54
Cognito User Pool does two things
Allows Sign-In Creates a JWT for you to use
55
Do Cognito User pools grant access to anything?
No, they just manage sign in and creation of JWTs. Most AWS resources can't use JWTs straight up, you need a translation layer.
56
SOme things Cognito User Pools provides
Signup/Sign In Cusomizable sign in web user interface MFA and other security features Can do signin from Facebook and others
57
Primary purpose of identity pool
Exchange unauthenticated users or an external identity info for temporary AWS creds. Includes user pool identities, Facebook, SAML, and others.
58
What services can you easily use with a JWT created from a successul Cognito User Pool login?
API Gateway can natively use the JWT and pass you through to Lambda
59
Can you use an identity pool with a user pool?
Yes, you can create an identity pool config to support external user repositories. The result though is that you now have to have a config for each different kind of token you will get from the external identity provider.
60
Benefit of using user pools integrated with external identitiy providers?
You will get a user pool JWT back, and then you can have a standard way to configure your identity pool to swap for creds (role for authenticated users and role for unauthenticated)
61
If you are setting up a real application to use a third party provider like Google to authenticate, what is likely needed?
Registering your app with the provider to know about it.
62
Once you complete and Identity Pool, what do you need to do to ensure proper access?
Go to IAM, configure the unauthenticated and authenticated access for the roles.
63
Key benefit of Workspaces
Access a desktop from anywhere maintaining apps and state
64
Key requirement for using Workspaces?
Implementation of a Directory Services product: Simple, Managed AD, or AD Connector
65
How do Workspaces handle networking?
ENI in a networking VPC You can use VPN or DX to get back to on-prem resources
66
Does Workspaces provide encryption at rest?
Yes. EBS +KMS. You can encrypt both root and user volumes, one of them, or none of them.
67
What are authentication and streaming gateways in Workspace?
The proxy if you will for external people connecting to the Workspaces. Talk to Directory Services to let people in.
68
Do workspaces run in your VPC?
No, they run in an AWS hosted VPC. They are injected into your networking VPC as are your directory services. Relize this means SG's come into play for direct ingress access.
69
Are Workspaces HA?
No, they run in one AZ and are susceptable to AZ outages. You can distribute WOrkspaces across AZs, but each Workspace is susceptable to AZ outage.
70
Does the Directoy Services - Managed Microsoft AD suport schema updates/exentions?
Yes, means you can install things like Exchange, Sharepoint, etc.
71
What types of trusts does Directory Services - Microsoft AD support?
All of them, one way and two way.
72
Is the Directory Services - Microsoft Ad HA?
Yes, minimum of two AZ with a DC in each.
73
MFA Directory Service - Microsoft AD supports?
RADIUS-based MFA
74
Best choice for \> 5000 users, trust relationships between your on prem diretory?
Directory Services - Microsoft AD
75
Can Directory Services -Managed AD support AWS services?
Yes, things like the Console, Workspaces, Connect, Chime, etc.
76
Does Directory Services - Microsoft AD run in your VPC?
No, runs in an AWS VPC, but is injected into your VPC via ENIs for the AD DCs. Becuase of this, there are SGs you need to be awaare of and configure.
77
Do you need to patch AD in Directory Services - Managed AD?
No, AWS handles.
78
Can you use multiple Directory Service - AD Connectors for resiliency?
Yes
79
What does Directory Services - AD connector need from a networking perspective?
2 subnets in a VPC Networking connectivity via VPN/DX to on prem AD. Injects ENI's into your VPC
80
What does Directory Services -AD connector give you for sizing options?
Small or larger
81
Where can you attach SCPs
ORG root container, ous, individual accounts
82
Do SCPs apply to the root management AWS account?
no
83
Role trust policy enabling all users of an account
"Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "sts:AssumeRole" }] }
84
Product formerly known as AWS SSO
IAM Identity Center
85
The region in which Control Tower Landing Zone is deployed into is called this
Home Region
86
Key services Control Tower uses to build an LZ
Service Catalog Cloudformation AWS Config IAM Identity Center (AWS SSO)
87
Default Control Tower OUs
Security Sandbox
88
Function of Security OU Sandbox in Control Tower
Log Archive and Audit Accounts (CloudTrail and Config Logs)
89
Control Tower Guardrail Types
Mandatory Strongly Recommended Elective
90
Preventative Guard Rail in CT
Stop you from doing things (SCPs). Enforced or not enabled. Used to block regions, disallow bucket changes, etc
91
Detective Guardrail in CT
Compliance checks via AWS Config
92
Control Tower Account Factory Benefits
Guardrails automatically added Admins or users can be self serve User can be automatically given admin to account Can apply standard network configuration Accounts can be closed or repurposed

Adrian C - AWS Pro Arch (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions