Associate Developer

Question 1

IAM (Identity and Access management)

Answer 1

 Centralized Control (Global, not region sepcific)  Shared Access  Granular Permissions  Identity federation (AD, Facebook, Linkedin)  Multifactor Authentication  Temporary Access to users/device/services  Password Rotation Policy  Integrates many AWS Services  Supports PCI DSS compliance

Question 2

IAM consists of ?

Answer 2

Users, Groups, Roles, Policy Document

Question 3

Security Token Service (STS)

Answer 3

1. Federation (AD) 2. Federation with Mobile Apps 3. Cross Account Access

Question 4

Federation

Answer 4

combining or joining a list of users (such as IAM) with list of users in another domain (such as AD, facebook etc)

Question 5

Federation (AD)

Answer 5

• Users Security Assertion Markup Language (SAML) • Grants temporary access based of the users AD credentials, does not need to be a user in IAM • Single Sign on allows users to log into AWS console without assigning IAM credentials

Question 6

Federation with Mobile Apps

Answer 6

• Use FB/Amazon/Google or other OpenID providers to login

Question 7

Cross Account Access

Answer 7

• Let’s users from one AWS account access resources in another

Question 8

Identity Broker

Answer 8

A Service that allows you to take an identity from point A and join it (federate it ) to Point B

Question 9

Identity Store

Answer 9

services like AD , Facebook, Google etc

Question 10

Identities

Answer 10

a user of a service like FB etc

Question 11

IAM STS setup steps

Answer 11

1. Develop an Identity Broker to communicate with LDAP and AWS STS 2. Identity Broker always authenticates with LDAP First then with AWS STS 3. Application then gets temporary access to AWS resources 4. Application uses that IAM role to interact with S3

Question 12

AWS Sign-in URL Format

Answer 12

https://.signin.aws.amazon.com/oauth

Question 13

IAM Role

Answer 13

An IAM role is an IAM entity that defines a set of permissions for making AWS service requests. IAM roles are not associated with a specific user or group. Instead, trusted entities assume roles, such as IAM users, applications, or AWS services such as EC2.

Question 14

API call used to generate temporary security credentials

Answer 14

AssumeRoleWithSAML Api request is made to get temporary securtiy credentials and generates a signin url

Question 15

SAML

Answer 15

Security Assertion Markup language

Question 16

API call for Web Identity Federation to get temporary security credentials

Answer 16

AssumeRoleWithWebIdentity API request is made to generate temporary security token

Question 17

AWS sign-in endpoint for SAML

Answer 17

https://signin.aws.amazon.com/saml