Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > AIM Basics > Flashcards

AIM Basics Flashcards

1
Q

What is AWS IAM?

A
  • AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources
  • IAM is a Global service
  • IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are some IAM features?

A
  • Shared access to your AWS account
  • Granular permissions
  • Secure access to AWS resources for applications that run on Amazon EC2
  • Multi-factor authentication (MFA)
  • Identity federation - 3rd party authenticated providers
  • Identity assurance - AWS CloudTrail activity logs
  • PCI DSS Compliance
  • Integrated with many AWS services
  • Evenly Consistent - high availability by replicating data across multiple servers
  • Free to use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a federated identity user?

A

Federated Identity users are users authenticated with a 3rd party provider such as Facebook, Google, Instagram, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the sign in options available for AWS?

A

Sign in with:
* AWS Management Console as a root user or IAM user
* AWS access portal as a user in IAM Identity Center
* Federated Identity user
* AWS Command Line Interface (CLI)
* Programmatic methods like SDK and API
* Sign in with AWS Builder ID - personal profile linked to AWS training

If you don’t use AWS tools, you must sign requests yourself such as sign-in API requests using AWS Signature Version 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How are you authorized to access AWS resources?

A
  • You must be authenticated (sign in) to AWS
  • Authenticated users can access resource based on their permission policies
  • Federated Identity users will indirectly assuming a role
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does IAM work?

A
  1. Principle makes an Authentication request
  2. On successfully authentication, IAM performs Authorization
    • IAM checks for Identity-based polices
    • Other policies
    • Resource-based policies
  3. Check Actions (Console) OR Operations (CLI/API)
    • EC2: RunInstance, StartInstance, StopInstance
    • IAM Service: CreateUser, DeleteUser, GetUser
    • S3: Create Bucket, DeleteBucket, ListBucket
  4. Perform Actions on Resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a Principle in AWS IAM?

A
  • A Principle is either a human identity (IAM User) or a collection of resources (IAM Role)
  • Principals include federated users and assumed roles
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the best security best practices in IAM?

A

* Don’t use the root account except for AWS account setup
* One physical user = One AWS use
* Assign users to groups and assign permissions to groups
* Create a strong password policy
* Use and enforce the use of Multi Factor Authentication (MFA)
* Update access keys when needed for use cases that require long-term credentials
* Create and use Roles for giving permissions to AWS services
* Apply least-privilege permissions
* Use Access Keys for Programmatic Access (CLI / SDK)
* Audit permissions of your account using IAM Credentials Report & IAM Access Advisor
* Never share IAM users & Access Keys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is attribute-based access control?

A
  • Attribute-based access control (ABAC) is an authorization strategy that lets you create fine-grained permissions based on user attributes, such as department, job role, and team name
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the difference between Actions and Operations?

A
  • Actions and Operations the principle wants to perform on the resource
    • CreateUser
    • GetUser
    • UpdateUser
    • DeleteUser
  • Actions in AWS Management Console
  • Operations in AWS CLI or AWS API
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What information is required to send a request to AWS?

A
  • Environment data - Information about the IP address, user agent, SSL enabled status
  • Principal - user or role
  • Actions (AWS Console) or operations (AWS CLI/API) - Requested actions to perform such as IAM:CreateUser
  • Resources - AWS Resource object upon
  • Resource data - Data to be updated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is AWS Authorization?

A
  • Authorization are permission to access AWS resources
  • Mut be Authorized (allowed) to complete your request
  • By default: all requests are denied
  • Explicit Allow any permissions to override the default
  • If any of the follow exist, then they must all allow the request:
    • Organizations SCP
    • IAM permissions boundary
    • session policy
  • An explicit deny in any policy overrides any allows
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is AWS Root User account?

A
  • The Root account is the master account used to manage all AWS Services.
  • We strongly recommend that you don’t use the root user for your everyday tasks
  • It should not be used or shared.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the steps to create a Root User account?

A
  1. Sign up for an AWS account by visiting the AWS website and clicking on the “Create an AWS Account” button.
  2. Provide the necessary information, such as email address, password, and billing information, to create your AWS account.
  3. Amazon requires credit card authorization of $1.00 to verify the billing information.
  4. Complete the identity verification process to activate your account.
  5. Select a Support Plan
  6. Log in to the AWS Management Console using your newly created credentials.
  7. Consider setting up multi-factor authentication (MFA) for added security on your account.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the tasks that require root user account?

A
  • Change your account settings
  • Restore IAM user permissions
  • Activate IAM access to the Billing and Cost Management console
  • View certain tax invoices
  • Close your AWS account
  • Register as a seller in the Reserved Instance Marketplace
  • Configure an Amazon S3 bucket to enable MFA (multi-factor authentication).
  • Edit or delete an Amazon Simple Queue Service (Amazon SQS) resource policy that denies all principals
  • Edit or delete an Amazon Simple Storage Service (Amazon S3) bucket policy that denies all principals
  • Sign up for AWS GovCloud (US)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What can you do in IAM Dashboard?

A
  • Dashboard shows Security Recommendations for best practice
  • Create Users, Groups, & Roles
  • Create Permission Policies
  • Manage Single-Signon Identity Providers
  • Configure Account Settings
    • Password Policy
    • Security Token Service (STS) Region Endpoints
  • View Access Reports
    • Access Analyzer
    • Credential Report
    • Organization Activity
    • Service Control Polices (SCPs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How do you create a new IAM User?

A
  1. Access Users from the IAM Dashboard
  2. Specify usename
  3. Select User Access Type
    • "Specify a user in IAM Identity Center" - For developers who need access to Access Keys
    • "I want to create a IAM user" - Single Signon for organization users
  4. Configure a console password
    • Autogenerate password
    • Custom password (IAM default password policy)
  5. Option to select "Users must create a new password at next sign-in"
  6. Configure user permission
    - Add user to group (recommended)
    - Copy permissions from another user
    - Attach policies directly (Inline Policy)
  7. Review and create
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How do IAM user sign into AWS?

A
  • Root User will sign-in with their email and Password
  • We can simplify the Root account sign-in by creating an Alias to use instead of the email address
  • IAM users sign-in with their AWS Account ID, Username, and Password
  • All accounts must be configure with MFA for security purposes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How to configure IAM Password Policy?

A
  • Strong password = higher security for your account
  • Good password policy helps protect against brute force on your account
  • IAM Dashboard - Access management > Account Settings > Edit
  • Configure IAM Password Policy:
    • Set minimum password length - default is 8 characters
    • Password strength (default is any of the 3 combination):
      • An uppercase letter
      • A lowercase letter
      • One number
      • A non-alphanumeric character ! @ # $ % ^ & * ( ) _ + - (hyphen) = [ ] { } | ‘
    • Other requirements:
      • Turn on password expiration
      • Password expiration require administrator reset
      • Allow users to change their own password
      • Prevent password reuse
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Multi Factor Authentication (MFA)?

A
  • You want to protect your Root Accounts and IAM users
  • MFA = password you know + security device you own
  • Main benefit of MFA: If a password is stolen or hacked, the account is not compromised
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How to Enable MFA on your computer or phone?

A
  1. IAM Dashboard Conolse > Users > [user] > Security Credentials > Assign MFA device
  2. Specify MFA device name
  3. MFA device type > Authenticator app
  4. Install and open Authenticator app
  5. Scan QR code
  6. Enter MFA code 1
  7. Wait 30 seconds
  8. Enter MFA code 2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is TOTP Authentication?

A
  • Time-based one-time password (TOTP) algorithm and support multiple tokens on a single device
  • Available for MFA Authenticator app
  • Available providers:
    • Google Authenticator (phone only)
    • Twilio Authy (multi-device)
    • Duo Mobile
    • Microsoft Authenticator
    • Symantec VIP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How to Enable MFA with a hardware security key?

A
  1. IAM Dashboard Conolse > Users > [user] > Security Credentials > Assign MFA device
  2. Specify MFA device name
  3. MFA device type > Security Key
  4. Connect your security key to your device via USB, Bluetooth, or NFC
  5. Tab the security key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is FIDO Security Key?

A
  • FIDO is a authentication protocol which uses Universal 2nd Factor (U2F) Security Key in performing MFA
  • Universal 2nd Factor (U2F) Security Key is an open authentication standard that enables internet users to securely access any number of online services
  • Hardware YubiKey is a USB Key Fob by Yubico (3rd Party)
  • Support multiple root accounts and IAM users using a single security key
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How to Enable MFA with a hardware TOTTP Token?

A
  1. IAM Dashboard Conolse > Users > [user] > Security Credentials > Assign MFA device
  2. Specify MFA device name
  3. MFA device type > Hardware TOTP token
  4. Enter the Key Fob serial number
  5. Enter MFA Code 1
  6. Wait 30 seconds
  7. Enter MFA Code 2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is Hardware TOTTP Token?

A
  • 6-digit numeric code based on time-based one-time password (TOTP) algorithm
  • Key Fob provided by Thales / Gemalto (3rd Party)
  • AWS GovCloud (US) Key Fob MFA Device is provided by SurePassID(3rd Party)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Can I use my U2F security key with multiple AWS accounts?

A

YES. AWS allows you to use the same U2F security key with several root and IAM users across multiple accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Can I use virtual, hardware, or SMS MFA with multiple AWS accounts?

A

NO. The MFA device or mobile phone number associated to virtual, hardware, and SMS MFA is bound to an individual AWS identity (IAM user or root account).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How many MFA devices can a user have?

A

Each user can have a maximum of 8 MFA devices assigned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How can MFA-enabled IAM users use AWS CLI?

A

MFA-enabled IAM users must call aws sts get-session-token API with their MFA code to create a temporary session:

     aws sts get-session-token \
     --serial-number arn-of-the-mfa-device \
	 --token-code code-from-token \
	 --duration-seconds 3600

Output:

  {
     "Credentials": {
          "SecretAccessKey": "secret-access-key",
	      "SessionToken": "temporary-session-token",
	      "Expiration": "expiration-date-time",
	      "AccessKeyId": "access-key-id"
     }
  }
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How do you create a virtual MFA device with AWS CLI?

A
  • Use the CLI command: aws iam create-virtual-mfa-device
      aws iam create-virtual-mfa-device \
  --virtual-mfa-device-name BobsMFADevice \
  --outfile C:/QRCode.png \
  --bootstrap-method QRCodePNG

Output:

  {  "VirtualMFADevice": 
    {  "SerialNumber": "arn:aws:iam::210987654321:mfa/BobsMFADevice"
    } 
}
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How do you create a virtual MFA device with AWS API?

A
  • Use CreateVirtualMFADevice to make an API call
 https://iam.amazonaws.com/?
			Action=CreateVirtualMFADevice
&VirtualMFADeviceName=ExampleName
&Version=2010-05-08
&AUTHPARAMS
  • Response information:
    • XML format
    • Base32 string seed
    • Device serial number
    • QR Code PNG image
    • Metadata with RequestId
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How do you assign a Virtual MFA device to a user with AWS CLI?

A
  • Use the CLI command: aws iam enable-mfa-device
      aws iam enable-mfa-device \
  --user-name Bob \
  --serial-number arn:aws:iam::210987654321:mfa/BobsMFADevice
  --authentication-code1 123455 \
  --authentication-code2 789012 \
  • Output:
    None
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How do you assign a Virtual MFA device to a user with AWS API?

A
  • Use EnableMFADevice to make an API call
      https://iam.amazonaws.com/?
			Action=EnableMFADevice
			&UserName=Bob
			&SerialNumber=R1234
			&AuthenticationCode1=234567
			&AuthenticationCode2=987654
			&Version=2010-05-08
			&AUTHPARAMS
  • Response information:
    • XML format
    • Metadata with RequestId
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

How do you unassign a Virtual MFA device to a user with AWS CLI?

A
  • Use the CLI command: aws iam deactivate-mfa-device
      aws iam deactivate-mfa-device \
  --user-name Bob \
  --serial-number arn:aws:iam::210987654321:mfa/BobsMFADevice
  • Output:
    None
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How do you unassign a Virtual MFA device to a user with AWS API?

A
  • Use DeactivateMFADevice to make an API call
      https://iam.amazonaws.com/?
			Action=DeactivateMFADevice
			&UserName=Bob
			&SerialNumber=R1234
			&Version=2010-05-08
			&AUTHPARAMS
  • Response information:
    • XML format
    • Metadata with RequestId
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How do you list Virtual MFA devices with AWS CLI?

A
  • Use the CLI command: aws iam list-virtual-mfa-devices
      aws iam list-virtual-mfa-devices

Output:

  {
    "VirtualMFADevices": [
        {
            "SerialNumber": 
							"arn:aws:iam::123456789012:mfa/ExampleMFADevice"
          },
          {
              "SerialNumber": 
										"arn:aws:iam::123456789012:mfa/Fred"
           }
       ]
   }
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How do you list Virtual MFA devices with AWS API?

A
  • Use ListVirtualMFADevices to make an API call
      https://iam.amazonaws.com/?
			Action=ListVirtualMFADevices
			&AssignmentStatus=Any
			&Version=2010-05-08
			&AUTHPARAMS
  • Response information:
    • XML format
    • VirtualMFADevices
      • Enable Date
      • Serial Number
      • User Information
    • Metadata with RequestId
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How do you resynchronize Virtual MFA devices with AWS CLI?

A
  • Use the CLI command: aws iam resync-mfa-device
      aws iam resync-mfa-device \
  --user-name Bob \
  --serial-number arn:aws:iam::210987654321:mfa/BobsMFADevice \
  --authentication-code1 123456 \
  --authentication-code2 987654
  • Output:
    None
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

How do you resynchronize Virtual MFA devices with AWS API?

A
  • Use ResyncMFADevice to make an API call
      https://iam.amazonaws.com/?
			Action=ResyncMFADevice
			&UserName=Bob
			&SerialNumber=R1234
			&AuthenticationCode1=234567
			&AuthenticationCode2=987654
			&Version=2010-05-08
			&AUTHPARAMS
  • Response information:
    • XML format
    • Metadata with RequestId
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

How do you delete a Virtual MFA devices with AWS CLI?

A
  • Use the CLI command: aws iam delete-virtual-mfa-device
      aws iam delete-virtual-mfa-device \
  --serial-number arn:aws:iam::210987654321:mfa/BobsMFADevice \
  • Output:
    None
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How do you delete a Virtual MFA devices with AWS API?

A
  • Use DeleteVirtualMFADevice to make an API call
      https://iam.amazonaws.com/?
			Action=DeleteVirtualMFADevice
			&SerialNumber=arn:aws:iam::123456789012:mfa/ExampleName
			&Version=2010-05-08
			&AUTHPARAMS
  • Response information:
    • XML format
    • Metadata with RequestId
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

How are MFA Serial Number reference in AWS CLI?

A

MFA Serial number reference based on the device type:
* MFA hardware device: GAHT12345678
* IAM Virtual MFA: arn:aws:iam::123456789012:mfa/ExampleName

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

How do users access AWS IAM?

A
  • AWS Management Console: protected by password + MFA
  • AWS Command Line Interface (CLI): protected by access keys
  • AWS Software Development Kit (SDK): for code - protected by access keys
  • AWS IAM Query API (API): issue HTTPS requests directly to the AWS service
45
Q

How an IAM user changes their own password?

A
  • AWS Console > choose your username (upper right nav bar), and then choose Security credentials > Update Console password
  • AWS CLI: aws iam change-password
    • Generate change-password.json file
           aws iam change-password \ 
--generate-cli-skeleton > change-password.json
  • Update change-password.json file with new password
        { "OldPassword": "3s0K_;xh4~8XXI", "NewPassword": "]35d/{pB9Fo9wJ" }
  • Upload the updated change-password.json file
       ```      aws iam change-password \ --cli-input-json file://change-password.json    ```
  • AWS API: ChangePassword
          
    https://iam.amazonaws.com/?Action=ChangePassword
    &OldPassword=U79}kgds4?
    &NewPassword=Lb0*1(9xpN
    &Version=2010-05-08
    &AUTHPARAMS
46
Q

How can you permit users to manage their credentials and MFA settings?

A
  • IAM users must have sufficient permissions to create, view, and deactivate MFA devices assigned to them
  • You can permit IAM users to access My security credentials to manage their own MFA by creating custom policy provided by provided AWS IAM
  • Assign the policy to the User Groups
  • Users will be force to setup MFA for their account before they can access resources
47
Q

What is IAM Users & Groups?

A
  • Users are people within your organization, and can be grouped
  • Groups only contain users, not other groups
  • Users don’t have to belong to a group, and user can belong to multiple groups
48
Q

What are some features in IAM Users?

A
  • Manage Access Keys
  • Set Permission Polices
  • Assign user to Groups
  • Create Tags
  • Manage Security Credentials
  • View Access Advisor
49
Q

What is the character limit for IAM Name and IDs?

A
  • Unique IDs: 128 characters, includes: User ID, Group ID, Role ID, Managed Policy ID, Server Certificate ID
  • Group Name, Policy Name: 128 characters
  • User Name, Role Name, Role Session Name: 64 characters
  • Switch Role: Path + RoleName can't exceed 64 characters
50
Q

What are Access Keys?

A
  • Access Keys are generated through the AWS Console
  • Users manage their own access keys
  • Use access keys for long term access
  • Use access keys to send programmatic calls to AWS from the AWS CLI, AWS Tools for PowerShell, AWS SDKs, or direct AWS API calls.
  • IAM will prompt to acknowlege the recommendation of using AWS CloudShell and AWS CLI V2 for IAM Identity Center
  • You can have a maximum of two access keys (active or inactive) at a time.
  • Access Keys are secret, just like password.
    - Access Key Id = username
    - Secret Access Key = password
  • Never share you Access Keys
51
Q

When to use Access Keys instead of IAM Roles?

A
  • Workloads that cannot use IAM Roles such as WordPress plugins
  • Third-party clients not hosted on AWS
  • AWS CodeCommit access
  • Amazon Keyspaces (for Apache Cassandra) access
52
Q

What are the different types of AWS Policies?

A
  • Identity-based policies - JSON policy, control actions of an identity (users, groups, roles)
  • Resource-based policies - JSON policy, attach to a resource
  • Permissions boundaries - JSON policy, set the maximum permissions that an identity-based policy can grant to an IAM entity
  • Organizations SCPs - JSON policie, grouping and centrally managing the AWS accounts
  • Access control lists (ACLs) - Not JSON format, control which principals in another account can access a resource
  • Session policies - use pass as a parameter when you programmatically create a temporary session for a role or federated user
53
Q

What are Identity-based policies?

A
  • Identity-based policies are JSON permission policies to control actions of an identity (users, groups, roles)
  • Further categorized:
    • Inline Policies - directly assign to a single user, group, or role
    • Managed Policies:
      • AWS managed policies - policies created and managed by AWS
      • Customer managed policies - policies created and managed by the customer
54
Q

What are Resource-based policies?

A
  • Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket.
  • Resource-based policies are inline policies
  • There are no managed resource-based policies
55
Q

How can you use Cross-Account Access?

A
  • Enable AWS Roles (Resource-based policies)
  • Specify the principle:
    • if principle and resource are in the same account - no identity-based policy is required
    • if principle and resource are in different accounts - an additional identity-based policy is required
56
Q

What is IAM Permissions Boundary policies?

A
  • Sets of Identity-based policies to control the maximum permissions for Users or Roles
  • It limits the user's permissions but does not provide permissions on its own
  • Delegate permissions management tasks, such as user creation, to IAM users in your account
  • Enforce the delegatee to assign the same Permission Boundary for new users they created

Use Cases:

  • Enable developer to create roles with escalating their access
  • Require developers to create roles with a boundary

Pro tip: Require roles and managed polices start with a namespace

57
Q

What is the best practice when using permissions boundaries?

A
  • Permissions boundaries use a managed IAM policy to restrict access
  • Policy cannot exceed 6,144 characters long
  • Can have up to 10 managed policies and 1 permissions boundary attached to an IAM role
  • Apply permissions boundaries to the IAM roles created by developers, rather than to the developers themselves
58
Q

What are Service control policies (SCPs)?

A
  • A service for grouping and centrally managing the AWS accounts that the business owns
  • Once enabled it will enabled for all accounts
  • SCPs are JSON policies that specify the maximum permissions for an organizational unit (OU) as well as Account Root user
  • An explicit Deny in any of these policies overrides the Allow

Use Cases:

  • Restrict access to specific AWS Regions
  • Prevent your IAM Principals from deleting common resources
  • Restrict service actions to all IAM entities except a specific role

Pro tip: Push restrictions common amount accounts up to SCPs.

59
Q

What are Access control lists (ACLs)?

A
  • Allow you to control which principals in another account can access a resource
  • Cannot be used to control access for a principal within the same account
  • Similar to Resource-based policies
  • Does not use the JSON policy document format
  • Example: Amazon S3, AWS WAF, and Amazon VPC
60
Q

What are Session Policies?

A
  • Policies that you pass as a parameter when you programmatically create a temporary session for a role or federated user
  • Permissions use both Identity-based and resource-based policy for access
  • An explicit deny in any of these policies overrides the allow
61
Q

How can you perform a session policy for Federated Identity users?

A
  • Can provide access keys of the IAM user to programmatically call the GetFederationToken API operation
  • Must also pass session policies
  • Permission results:
    intersection (Identity-based + Session policy)
62
Q

How can you perform a session policy with resource-based policy?

A
  • Must specify the ARN of the user or role as a principal
  • Permission results:
    All Resource-based policy + Intersection(Identity-based + Session policy) )
63
Q

How can you perform a session policy with permissions boundary?

A
  • Set the maximum permissions for a user or role that is used to create a session
  • Permission results:
    Intersection (Resource-based policy + Identity-based + Session policy)
64
Q

What is the Role Session Duration?

A
  • IAM user - 15 minutes to 36 hours, 12 hours is the default
  • AWS account owners - maximum and default is 1 hour
65
Q

What is the Role Session Policy JSON character limit?

A
  • Content’s can’t exceed 2,048 characters
  • Can pass a maximum of 10 managed policy when session is created
  • Can only pass one JSON document for a role or federated user
66
Q

What are attribute-based access control (ABAC)?

A
  • Authorization strategy that defines permissions based on attributes called Tags
  • Use PrincipalTag to indicate what principle tags are allowed to access the resource
67
Q

What are the ways to granular access with attribute-based access control (ABAC) in IAM?

A
  • IAM Principle Tags- Tag entities with access control attributes
  • IAM Session Tags - Tag sessions with access control attributes
  • Tags on AWS Resource - Tag resources with access control attributes
  • Tags on AWS IAM Polices - Control access based on tags
  • Tags on AWS Organization - Standardized tag names, value, and capitalization. Control allowable values, investigate difference.
68
Q

What is the character limit for Role Session Tags?

A
  • Session tags must meet the tag key limit of 128 characters and the tag value limit of 256 characters
  • You can pass up to 50 session tags in a single session
69
Q

How does AWS policies access granted?

A
  • All access requests start with DENY
  • If using Service Control Polices (CSPs) - CSP must Allow
  • if using Permission Boundaries - Permission Boundary must Allow
  • if same account access - Identity or Resource policy must Allow
  • if direct cross account access - Both Identity AND Resource Policy must Allow
  • if using session policy - Session AND Identity Policy must Allow
70
Q

What are XML (SAML) character limits?

A
  • 100,000 characters
  • Applies to assume-role-with-saml CLI or AssumeRoleWithSAML API operation
71
Q

What are policies related to Root User?

A
  • Affected by some policy types but not others
  • Cannot attach identity-based policies
  • Cannot set the permissions boundary
  • Affected by Service Control Policies (SCPs)
  • Can specify the root user as the principal in a resource-based policy or an Access Control List (ACL)
72
Q

How does Policy Inheritance work?

A
  • Inline: add directly to a single user, group, or role and maintain a strict one-to-one relationship
  • Policies Inheritance: Users inherit the policies within the group
73
Q

What is IAM Permissions?

A
  • Permissions are defined by policies attached to the user directly or through groups.
  • Users or Groups can be assigned JSON documents called policies
  • These policies define the permissions of the users
  • Apply the least privilege principle: don’t give more permissions than a user needs
  • Most policies are stored in AWS as JSON documents.
74
Q

How are IAM Policies Structure?

A
  • Version: policy language version, in the format: “2012 -10 - 17”
  • Id: an identifier for the policy (optional)
  • Statement: one or more individual statements (required)
    • Sid: an identifier for the statement (optional)
    • Effect: whether the statement allows or denies access (Allow, Deny)
    • Principal: Account, User or Role to which this policy applied to
    • Action: list of actions this policy allows or denies
    • Resource: list of resources to which the actions applied to
    • Condition: conditions for when this policy is in effect (optional)
75
Q

How does AWS evaluate multiple statements in a single permission policy or multiple policies in a single request?

A
  • A logical OR will be applied across the statements
  • If multiple policies appy to a single request, AWS applies a logical OR accross all those policies when evaluating them
76
Q

What are AWS access levels?

A

Access Level Groupings:
* Full: access to all actions within the specified access level classification
* Limited: access to one or more but not all actions within the specified access level classification
* None: no access
* (empty): IAM does not recognize this service

Access Level Classification:
* List: can list objects but cannot view the object’s content
* Read*: can read the object’s content
* Tagging: can change the objects’s tag
* However, CreateRole action allows tagging a role, but also Write access
* Write: can create, delete or modify object’s content
* Permissions Management: can modify the resource permission in the service
* Example: S3 actions PutBucketPolicy and DeleteBucketPolicy have Permissions Management access level
* It’s important to restrict or regularly monitor this type of policies

77
Q

What is the JSON document character limits?

A

Inline Policies:
* User policy - can’t exceed 2,048 characters.
* Group policy - can’t exceed 5,120 characters.
* Role policy - can’t exceed 10,240 characters.

Managed Policies:
* All policies - can’t exceed 6,144 characters.

IAM doesn’t count white space when calculating the size of a policy against this limit.

78
Q

What is are Amazon Resource Names (ARNs)?

A
  • Amazon Resource Names (ARNs) uniquely identify AWS resources in AWS JSON policies
  • Format:
    • arn:partition:service:region:account-id:resource-id
    • arn:partition:service:region:account-id:resource-type:resource-id
    • partition:
      • aws - AWS Regions
      • aws-cn - China Regions
      • aws-us-gov - AWS GovCloud (US) Regions
    • service - service namespace that identifies the AWS product
    • region - Region code. For example, us-east-2 for US East (Ohio)
    • account-id - ID of the AWS account
    • resource-type - The resource type - For example, vpc for a virtual private cloud (VPC)
    • resource-id - ID of the resource
  • ARN paths - forward slash (/), equals (=), comma (,), period (.), at (@), and hyphen (-).
  • Using wildcards in paths - “Resource”:”arn:aws:iam::123456789012:user/*”
79
Q

How do you create a permission policy in IAM?

A
  • IAM > Policies > Create Policy
  • Select Visual or JSON
  • Select Actions to generate CloudFormation template, optimize for readability or size
  • Select a service:
    • Auto Sccaling
    • CloudFront
    • EC2
    • IAM
    • Lambda
    • RDS
    • S3
    • SNS (Simple Notification Service)
  • Add Access Level Actions:
    • List
    • Read
    • Write (create/update/delete)
    • Permission Management (permission access actions such as CreatePolicy)
    • Tagging (tagging actions)
  • Select Effect (Add/Deny)
  • Select Resource ARN:
    • Access-Report
    • Group
    • Instance-Profile
    • MFA
    • OIDC-Provider
    • Policy
    • Role
    • SAML-Provider
    • Server-Certificate
    • SMS-MFA
    • User
80
Q

What is IAM CloudTrail events?

A
  • Generate policies based on access activity
  • Require date/time period, trail logs and service Role
81
Q

What are user groups membership?

A
  • A user group is a collection of IAM users
  • Use groups to specify permissions for a collection of users
  • A user can be a member of up to 10 groups at a time
82
Q

What are Tags in IAM?

A
  • Tags are key-value pairs that you can add to AWS resources to help identify, organize, or search for resources.
  • A Tag Key (for example, CostCenter, Environment, Project, or Purpose)
  • An optional field known as a Tag Value (Omitting the tag value is the same as using an empty string)
  • Tag Keys and values requirements:
    • case sensitive
    • any combination of letters, numbers, spaces and _ . : / = + - @ symbols
83
Q

What are the character limits for Tags?

A
  • Tag Key: 128 characters
  • Tag Value: 256 characters
  • Empty tag value has a length of 0 characters
84
Q

What are the available options in IAM User Security Credentials?

A
  • Manage console access
  • Reset user password
  • Manage Access Keys
  • Use SSH public keys to authenticate access to AWS CodeCommit* repositories
  • Generate HTTPS Git credentials for AWS CodeCommit
  • Generate credentials for Amazon Keyspaces (for Apache Cassandra)
  • X.509 Signing certifications
85
Q

What is CodeCommit?

A
  • CodeCommit is a secure, highly scalable, managed source control service that hosts private Git repositories
  • Designed to integrate with other AWS services
  • Access authentication with:
    • SSH public keys - maximum of five SSH public keys (active or inactive) at a time
    • Generate HTTS username & password credentials - maximum 2 sets (active or inactive) at a time
86
Q

What is Amazon Keyspace for Apache Cassandra?

A
  • Amazon Keyspaces (for Apache Cassandra) is a scalable, highly available, and managed Apache Cassandra-compatible database service
  • Ways to generate access credentials:
    • Users > Security Credentials
    • AWS CLI > aws iam create-service-specific-credential
    • AWS API > CreateServiceSpecificCredential
87
Q

What is X.509 certificates?

A
  • AWS server certicate is a X.509 v3 data structure that binds the public key in the certificate to the subject of the certificate.
  • An SSL/TLS certificate is signed by Certificate Authority (CA) and contains the name of the server, validaity period, public key and signature, etc…
  • Use Cases:
    • Amazon API Gateway for custom domain name
    • AWS CloudFormation - ACM certificates
    • Amazon CloudFront to distribute website content delivery
    • Code Signing for AWS IoT
    • Elastic Beanstalk
    • Elastic Load Balancing
  • Ways to create X.509 certificates:
    • IAM User > Security Credentials - Maximum of 2 X.509 certificates (active or inactive) at a time
    • AWS Certificate Manager (ACM)
88
Q

What are IAM Roles?

A
  • IAM Roles are permission policies for services
  • An IAM Role is both an identity and a resource that supports resource-based policies - Must attach both a trust policy and an identity-based policy
  • It is associated with a service instead of an identity user
  • Users have permanent long-term credentials, but roles provide temporary credentials
  • Common roles:
    • EC2 Instance Roles
    • Lambda Function Roles
    • Roles for CloudFormation
89
Q

When can you assume an IAM role?

A

When the following situation occurs:
* Federated user access
* Temporary IAM user/role permissions
* Cross-account access - trusted principle from another AWS account
* Cross-service access
* Principal permissions - permission given to IAM user/role to access cross service resource
* Service role - delegate permission to assumes a service on your behalf (such as permission boundary)
* Service-linked role - type of service role that linked to another AWS service
* Applications running on Amazon EC2 - making AWS CLI or AWS API requests

90
Q

What policies are use with IAM Role?

A
  • Trust Policy - defined which principle can assume the role
  • Identity-based policies (inline and managed) - define permissions the user of the role to perform actions on the resource
91
Q

How do you create an IAM Role?

A
  • IAM > Roles > Create Role
  • Select the Trusted Entity type
    • AWS Service (EC2, Lambda)
    • AWS Accounts
    • Web Identity (federated user)
    • SAML 2.0 Federation (corporate active directory)
    • Custom Trust Policy
  • Provide Use Case for services to call on it’s behalf
  • Attach a permission policy
  • Set a permission boundary (optional)
  • Provide Role name and description
  • Add Tags (optional)
92
Q

What are IAM Roles Anywhere?

A
  • Authenticate your non AWS workloads and securely provide access to AWS services
  • Can configure existing Roles policies to Roles Anywhere
  • Create a Certificate Authority (CA) and Trust Anchor to establish trust between AWS and Certificate Authority (CA)
93
Q

How can you assume roles with Switch Roles in AWS Console?

A
  • Administrator will provide you a link to access the Switch Role page which have Account ID and Role Name already filled
  • Sign in to AWS Console and access the username on the navbar and choose Switch Role > manually enter the Account ID and Role Name
94
Q

What is the limitation when you Switch Roles?

A
  • You can switch to a role only after you sign in as an IAM user or a federated user.
  • If you launch an Amazon EC2 instance to run an application, the application can assume a role through its instance profile
  • You cannot switch to a role when you sign in as the AWS account root user
  • Only one set of permissions can be in effect at a time - cannot make use of his power-user privileges for your account if you’re switching roles to another account.
  • Switching roles using the AWS Management Console only works with accounts that do not require an ExternalId
95
Q

How can you return to your original permission once you Switch Roles?

A
  • Click on the role display name on the navbar and then choose “Back to YourName@YourAccountID”.
96
Q

What are IAM Security Tools?

A
  1. IAM Credentials Report (account-level)
    • a report that lists all your account’s users and the status their various credentials
  2. IAM Access Advisor (user-level)
    • Shows the service permission granted to a user and when those services were last accessed
    • You can use this information to revise your policy
97
Q

What’s the AWS CLI?

A
  • Command line interface (CLI) is a tool allows you to interact with AWS services using commands
  • Direct access to the public APIs of AWS services
  • You can develop scripts to manage your resources
  • It’s open-source https://github.com/aws/aws-cli
  • Alternative to using AWS Management Console
  • Developed upon Python SDK (boto3)
98
Q

How do you install AWS CLI on Windows?

A
  • Search for AWS CLI v2 on Windows
  • Download MSI install and install it
  • Open cmd line prompt
  • Run aws --version
  • The output will show if AWS CLI is installed: aws-cli/2.10.0 Python/3.11.2 Windows/10 exe/AMD64 prompt/off
99
Q

How do you install AWS CLI on Mac OS?

A
  • Search for AWS CLI v2 on Mac OS
  • Download and install the PKG file
  • Select install for all users on this computer
  • Open a terminal on Mac
  • Run aws --version
  • The output will show if AWS CLI is installed: aws-cli/2.10.0 Python/3.11.2 Windows/10 exe/AMD64 prompt/off
100
Q

How do you install AWS CLI on Linux?

A
  • Run the 3 commands sequentially:
$ curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
     
unzip awscliv2.zip
     
sudo ./aws/install
101
Q

What do you do if you receive errors when running AWS CLI Commands?

A

Ensure you’re using the most recent version of AWS CLI

102
Q

What is the character limit for Paths?

A
  • 512 characters
103
Q

What is AWS CloudShell?

A
  • A browser-based CLI to manage AWS resources from a terminal in your browser
  • Use the same AWS Management Console login
  • 1 GB of persistent storage
  • Import/export files
104
Q

What is AWS SDK?

A
  • AWS Software Development Kit (AWS SDK)
  • Language-specific APIs (set of libraries)
  • Enables you to access and manage AWS services
    programmatically
  • Embedded within your application
  • Supports:
    • SDKs (JavaScript, Python, PHP, .NET, Ruby, Java, Go, Node.js,
      C++)
    • Mobile SDKs (Android, iOS, …)
    • IoT Device SDKs (Embedded C, Arduino, …)
  • Example: AWS CLI is built on AWS SDK for Python (boto3)

Examples:

  • We have to use the AWS SDK when coding against AWS Services such as DynamoDB
105
Q

What is best practice when creating permission policies?

A
  • Break up policies by resource type due to limited JOSN document size
  • Avoid define multiple permissions in a single statement
  • Grant least privilege
  • Understand access level groupings
  • Use IAM Access Analyzer & CloudTrail to generate and validate user access information
106
Q

What is the Shared Responsibility Model for IAM?

A

AWS:

  • Infrastructure (global
    network security)
  • Configuration and
    vulnerability analysis
  • Compliance validation

You:

  • Users, Groups, Roles, Policies
    management and monitoring
  • Enable MFA on all accounts
  • Rotate all your keys often
  • Use IAM tools to apply
    appropriate permissions
  • Analyze access patterns &
    review permissions
107
Q

How do you setup a billing budget to be alerted in case of over spending?

A
  1. Root account must provide IAM user with AdministratorAccess to access Billing Information
  2. Log on to our IAM User account
  3. Go to My Account > My Billing Dashboards
  4. Click on Budget > Create a Budget
  5. Choose premade templates or customized your own template:
    • Zero spending budget
    • Monthly cost budget
    • Daily savings Plans coverage budget
  6. Add email recipients to be notified
  7. Click Create Budget
108
Q

How do you allow IAM Users who are administrator access to access Billing & Cost Management Console?

A
  1. Log onto Root account
  2. Click My Account
  3. Click Edit under IAM User and Role access to Billing Information
  4. Check Activate IAM Access
  5. Click Update
109
Q

Summarize the IAM Section

A
  • Users: mapped to a physical user, has a password for AWS Console
  • Groups: contains users only
  • Policies: JSON document that outlines permissions for users or groups
  • Roles: for EC2 instances or AWS services
  • Security: MFA + Password Policy
  • AWS CLI: manage your AWS services using the command-line
  • AWS SDK: manage your AWS services using a programming language
  • Access Keys: access AWS using the CLI or SDK
  • Audit: IAM Credential Reports & IAM Access Advisor

AWS (30 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions