AWS IAM Flashcards
AWS IAM ? what is it ?
IAM is the AWS Identity and Access Management Service.
IAM is used to securely control individual and group access to AWS resources.
IAM makes it easy to provide multiple users secure access to AWS resources.
IAM can be used to manage ?
- Users.
- Groups.
- Access policies.
- Roles.
- User credentials.
- User password policies.
- Multi-factor authentication (MFA).
- API keys for programmatic access (CLI).
By default new users are created with … ?
By default new users are created with NO access to any AWS services – they can only login to the AWS console.
Permission must be explicitly granted to allow a user to access an AWS service.
Each IAM user has three main components ?
- A username.
- A password.
- Permissions to access various resources.
IAM is not used for application-level authentication. T/F
TRUE
You can authenticate using an MFA device in the following three ways ?
Through the AWS Management Console – the user is prompted for a user name, password, and authentication code.
Using the AWS API – restrictions are added to IAM policies and developers can request temporary security credentials and pass MFA parameters in their AWS STS API requests.
Using the AWS CLI by obtaining temporary security credentials from STS (aws sts get-session-token).
IAM is universal (global) ? T/F
IAM is universal (global) and does not apply to regions.
IAM is eventually consistent.
IAM replicates data across multiple data centers around the world.
Temporary security credentials consist of ?
Temporary security credentials consist of the AWS access key ID, secret access key, and security token.
IAM Elements - Principles?
- An entity that can take an action on an AWS resource.
- Your administrative IAM user is your first principal.
- You can allow users and services to assume a role.
- IAM supports federated users.
- IAM supports programmatic access to allow an application to access your AWS account.
- IAM users, roles, federated users, and applications are all AWS principals.
IAM Elements - Requests
Principals send requests via the Console, CLI, SDKs, or APIs.
Requests are:
- Actions (or operations) that the principal wants to perform.
- Resources upon which the actions are performed.
- Principal information including the environment from which the request was made.
Request context – AWS gathers the request information:
- Principal (requester).
- Aggregate permissions associated with the principal.
- Environment data, such as IP address, user agent, SSL status etc.
- Resource data, or data that is related to the resource being requested.
IAM Elements - Authentication
- An entity that can take an action on an AWS resource.
- Your administrative IAM user is your first principal.
- You can allow users and services to assume a role.
- IAM supports federated users.
- IAM supports programmatic access to allow an application to access your AWS account.
- IAM users, roles, federated users, and applications are all AWS principals.
IAM Elements - Requests
Principals send requests via the Console, CLI, SDKs, or APIs.
Requests are:
- Actions (or operations) that the principal wants to perform.
- Resources upon which the actions are performed.
- Principal information including the environment from which the request was made.
Request context – AWS gathers the request information:
- Principal (requester).
- Aggregate permissions associated with the principal.
- Environment data, such as IP address, user agent, SSL status etc.
- Resource data, or data that is related to the resource being requested.
I AM Elements - Authorization Principles ?
IAM uses values from the request context to check for matching policies and determines whether to allow or deny the request.
IAM policies are stored in IAM as JSON documents and specify the permissions that are allowed or denied.
IAM policies can be:
- User (identity) based policies.
- Resource-based policies.
IAM checks each policy that matches the context of your request.
If a single policy has a deny action IAM denies the request and stops evaluating (explicit deny).
Evaluation logic:
- By default all requests are denied (implicit deny).
- An explicit allow overrides the implicit deny.
- An explicit deny overrides any explicit allows.
Only the root user has access to all resources in the account by default.
IAM PRinciples - Actions ? What is it ?
Actions are defined by a service.
Actions are the things you can do to a resource such as viewing, creating, editing, deleting.
Any actions on resources that are not explicitly allowed are denied.
To allow a principal to perform an action you must include the necessary actions in a policy that applies to the principal or the affected resource.
IAM Elements - Resources, What is it ?
A resource is an entity that exists within a service.
E.g. EC2 instances, S3 buckets, IAM users, and DynamoDB tables.
Each AWS service defines a set of actions that can be performed on the resource.
After AWS approves the actions in your request, those actions can be performed on the related resources within your account.
What are the available Authentication Methods ?
Console password:
Access Keys:
Server certificates:
Whats the Console password Factors ?
A password that the user can enter to sign into interactive sessions such as the AWS Management Console.
You can allow users to change their own passwords.
You can allow selected IAM users to change their passwords by disabling the option for all users and using an IAM policy to grant permissions for the selected users.
Define the principles of Access Keys Authentication Method ?
- A combination of an access key ID and a secret access key.
- You can assign two active access keys to a user at a time.
- These can be used to make programmatic calls to AWS when using the API in program code or at a command prompt when using the AWS CLI or the AWS PowerShell tools.
- You can create, modify, view, or rotate access keys.
- When created IAM returns the access key ID and secret access key.
- The secret access is returned only at creation time and if lost a new key must be created.
- Ensure access keys and secret access keys are stored securely.
- Users can be given access to change their own keys through IAM policy (not from the console).
- You can disable a user’s access key which prevents it from being used for API calls.
Server certificates Authentication Principles ?
SSL/TLS certificates that you can use to authenticate with some AWS services.
AWS recommends that you use the AWS Certificate Manager (ACM) to provision, manage and deploy your server certificates.
Use IAM only when you must support HTTPS connections in a region that is not supported by ACM.
What is an IAM user ?
An IAM user is an entity that represents a person or service.
Can be assigned:
- An access key ID and secret access key for programmatic access to the AWS API, CLI, SDK, and other development tools.
- A password for access to the management console.
By default users cannot access anything in your account.
What is a Policy ?
Policies are documents that define permissions and can be applied to users, groups, and roles.
Policy documents are written in JSON (key value pair that consists of an attribute and a value).
All permissions are implicitly denied by default.
The most restrictive policy is applied.
The IAM policy simulator is a tool to help you understand, test, and validate the effects of access control policies.
The Condition element can be used to apply further conditional logic.
IAM Policy Evaluation Logic ?
By default, all requests are implicitly denied. (Alternatively, by default, the AWS account root user has full access).
An explicit allow in an identity-based or resource-based policy overrides this default.
If a permissions boundary, Organizations SCP, or session policy is present, it might override the allow with an implicit deny.
An explicit deny in any policy overrides any allows.
IAM Instance Profiles, What is it ?
An instance profile is a container for an IAM role that you can use to pass role information to an EC2 instance when the instance starts.
An instance profile can contain only one IAM role, although a role can be included in multiple instance profiles.
Cross Account Access ? Principles
Useful for situations where an AWS customer has separate AWS account – for example for development and production resources.
Cross Account Access makes is easier to work productively within a multi-account (or multi-role) AWS environment by making is easy to switch roles within the AWS Management Console.
Can sign-in to the console using your IAM user name and then switch the console to manage another account without having to enter another user name and password.
Lets users from one AWS account access resources in another.
To make a request in a different account the resource in that account must have an attached resource-based policy with the permissions you need.
Or you must assume a role (identity-based policy) within that account with the permissions you need.
