Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner (Digital Cloud) > AWS Identity and Access Management > Flashcards

AWS Identity and Access Management Flashcards

1
Q

What is IAM?

A

AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What can you control with IAM?

A

You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does IAM make it easy to do?

A

IAM makes it easy to provide multiple users secure access to AWS resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How is the IAM set up process?

A

When you first create an AWS account, you begin with a single sign-in identity that has complete access to all AWS services and resources in the account.

This identity is called the AWS account root user and is accessed by signing in with the email address and password that you used to create the account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What can IAM be used to manage?

A

IAM can be used to manage:

Users.
Groups.
Access policies.
Roles.
User credentials.
User password policies.
Multi-factor authentication (MFA).
API keys for programmatic access (CLI).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What features does IAM provide?

A

IAM provides the following features:

Shared access to your AWS account.
Granular permissions.
Secure access to AWS resources for application that run on Amazon EC2.
Multi-Factor authentication.
Identity federation.
Identity information for assurance.
PCI DSS compliance.
Integrated with may AWS services.
Eventually consistent.
Free to use.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the ways that you can interact with IAM?

A

You can work with AWS Identity and Access Management in any of the following ways:

AWS Management Console.
AWS Command Line Tools.
AWS SDKs.
IAM HTTPS API.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What access do new users have by default?

A

By default new users are created with NO access to any AWS services – they can only login to the AWS console.

Permission must be explicitly granted to allow a user to access an AWS service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an IAM user?

A

IAM users are individuals who have been granted access to an AWS account.

They are an entity that represents a person or service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What can you assign to IAM User?

A

Can be assigned:

An access key ID and secret access key for programmatic access to the AWS API, CLI, SDK, and other development tools.
A password for access to the management console.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three components of IAM users?

A

Each IAM user has three main components:

A username.
A password.
Permissions to access various resources.

You can apply granular permissions with IAM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What individual security credentials can you assign to users?

A

You can assign users individual security credentials such as access keys, passwords, and multi-factor authentication devices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is IAM not used for?

A

IAM is not used for application-level authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What can Identify Federations be configured to do?

A

Identity Federation (including AD, Facebook etc.) can be configured allowing secure access to resources in an AWS account without creating an IAM user account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Who can MFA be enabled for?

A

Multi-factor authentication (MFA) can be enabled/enforced for the AWS account and for individual users under the account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does MFA use?

A

MFA uses an authentication device that continually generates random, six-digit, single-use authentication codes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can you authenticate using an MFA device?

A

You can authenticate using an MFA device in the following two ways:

Through the AWS Management Console – the user is prompted for a user name, password, and authentication code.
Using the AWS API – restrictions are added to IAM policies and developers can request temporary security credentials and pass MFA parameters in their AWS STS API requests.
Using the AWS CLI by obtaining temporary security credentials from STS (aws sts get-session-token).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the best practice for MFA on the root account?

A

It is a best practice to always setup multi-factor authentication on the root account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Is IAM universal?

A

IAM is universal (global) and does not apply to regions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Does IAM replicate data across the world?

A

IAM replicates data across multiple data centers around the world.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the root account?

A

The “root account” is the account created when you setup the AWS account.

It has complete Admin access and is the only account that has this access by default.

It cannot be restricted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is best practice for root account?

A

It is a best practice to avoid using the root account for anything other than billing.
Don’t use the root user credentials.
Don’t share the root user credentials.
Create an IAM user and assign administrative permissions as required.
Enable MFA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What access does power user have ?

A

Power user access allows all permissions except the management of groups and users in IAM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What consists of temporary security credentials?

A

Temporary security credentials consist of the AWS access key ID, secret access key, and security token.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What can IAM do with temporary security credentials?

A

IAM can assign temporary security credentials to provide users with temporary access to services/resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What must you provide to sign in to AWS?

A

To sign-in you must provide your account ID or account alias in addition to a user name and password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is a console password?

A

Console password:

A password that the user can enter to sign in to interactive sessions such as the AWS Management Console.
You can allow users to change their own passwords.
You can allow selected IAM users to change their passwords by disabling the option for all users and using an IAM policy to grant permissions for the selected users.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is an access key?

A

A combination of an access key ID and a secret access key.

29
Q

How many active access keys can you assign to a user at a time?

A

You can assign two active access keys to a user at a time.

30
Q

What can access keys be used to do?

A

These can be used to make programmatic calls to AWS when using the API in program code or at a command prompt when using the AWS CLI or the AWS PowerShell tools.

31
Q

What can you do to access keys?

A

You can create, modify, view, or rotate access keys.

32
Q

What does IAM return when created?

A

When created IAM returns the access key ID and secret access key.

The secret access is returned only at creation time and if lost a new key must be created.

33
Q

Can users change their own keys?

A

Users can be given access to change their own keys through IAM policy (not from the console).

34
Q

Can user access keys be disabled?

A

You can disable a user’s access key which prevents it from being used for API calls.

35
Q

What are server certificates?

A

SSL/TLS certificates that you can use to authenticate with some AWS services.
AWS recommends that you use the AWS Certificate Manager (ACM) to provision, manage and deploy your server certificates.
Use IAM only when you must support HTTPS connections in a region that is not supported by ACM.

36
Q

What is the account root user credential?

A

The account root user credentials are the email address used to create the account and a password.

37
Q

Can IAM users represent applications?

A

IAM users can be created to represent applications, and these are known as “service accounts”.

38
Q

How many IAM users can an AWS account have?

A

You can have up to 5000 users per AWS account.

39
Q

How is a user account identified?

A

Each user account has a friendly name and an ARN which uniquely identifies the user across AWS.
A unique ID is also created which is returned only when you create the user using the API, Tools for Windows PowerShell, or the AWS CLI.

40
Q

Can access key id and secret access key be used to login to AWS console?

A

The Access Key ID and Secret Access Key are not the same as a password and cannot be used to login to the AWS console.

The Access Key ID and Secret Access Key can only be used once and must be regenerated if lost.

41
Q

What password policy does IAM have?

A

A password policy can be defined for enforcing password length, complexity etc. (applies to all users).

You can allow or disallow the ability to change passwords using an IAM policy.

Access keys and passwords should be changed regularly.

42
Q

What is a group in IAM?

A

Groups are collections of users and have policies attached to them.

43
Q

What isn’t a group in IAM?

A

A group is not an identity and cannot be identified as a principal in an IAM policy.

44
Q

What can you use groups for?

A

Use groups to assign permissions to users.

45
Q

What is the best practice when assigning permissions for groups?

A

Use the principle of least privilege when assigning permissions.

46
Q

What is the constraint of groups?

A

You cannot nest groups (groups within groups).

47
Q

What is a role in IAM?

A

Roles are created and then “assumed” by trusted entities and define a set of permissions for making AWS service requests.

48
Q

What can you do with IAM roles?

A

With IAM Roles you can delegate permissions to resources for users and services without using permanent credentials (e.g. user name and password).

49
Q

How does IAM users or services obtain permission to make AWS calls?

A

IAM users or AWS services can assume a role to obtain temporary security credentials that can be used to make AWS API calls.

50
Q

Are ther credentials associated with role?

A

There are no credentials associated with a role (password or access keys).

51
Q

Who can a role be assigned to?

A

A role can be assigned to a federated user who signs in using an external identity provider.

52
Q

What does IAM roles most commonly use?

A

Temporary credentials are primarily used with IAM roles and automatically expire.

53
Q

How can you assume a role?

A

Roles can be assumed temporarily through the console or programmatically with the AWS CLI, Tools for Windows PowerShell, or the API.

54
Q

How does IAM roles work with EC2 instances?

A

IAM roles can be used for granting applications running on EC2 instances permissions to AWS API requests using instance profiles.

55
Q

How many roles can be assigned to an EC2 instance at any time?

A

Only one role can be assigned to an EC2 instance at a time.

56
Q

When can the IAM role be assigned to EC2 instance?

A

A role can be assigned at the EC2 instance creation time or at any time afterwards.

57
Q

When must instance profiles be created manually?

A

When using the AWS CLI or API instance profiles must be created manually (it’s automatic and transparent through the console).

58
Q

How does application get security certificate?

A

Applications retrieve temporary security credentials from the instance metadata.

59
Q

What are the rules for Role Delegation?

A

Role Delegation:

Create an IAM role with two policies:
Permissions policy – grants the user of the role the required permissions on a resource.
Trust policy – specifies the trusted accounts that are allowed to assume the role.
Wildcards (*) cannot be specified as a principal.
A permissions policy must also be attached to the user in the trusted account.

60
Q

What are IAM Policies?

A

Policies are documents that define permissions and can be applied to users, groups, and roles.

61
Q

What language are IAM policies written in?

A

Policy documents are written in JSON (key value pair that consists of an attribute and a value).

62
Q

What is the default permission for IAM policies?

A

All permissions are implicitly denied by default.

The most restrictive policy is applied.

63
Q

What is the use of IAM policy simulator?

A

The IAM policy simulator is a tool to help you understand, test, and validate the effects of access control policies.

64
Q

What is AWS Security Token Service STS?

A

The AWS STS is a web service that enables you to request temporary, limited-privilege credentials for IAM users or for users that you authenticate (federated users).

65
Q

What is the difference between temporary security credentials and long term access key credentials?

A

Temporary security credentials are short-term.

They can be configured to last anywhere from a few minutes to several hours.

After the credentials expire, AWS no longer recognizes them or allows any kind of access to API requests made with them.

Temporary security credentials are not stored with the user but are generated dynamically and provided to the user when requested.

When (or even before) the temporary security credentials expire, the user can request new credentials, if the user requesting them still has permission to do so.

66
Q

What are the advantages of AWS STS?

A

You do not have to distribute or embed long-term AWS security credentials with an application.

You can provide access to your AWS resources to users without having to define an AWS identity for them (temporary security credentials are the basis for IAM Roles and ID Federation).

The temporary security credentials have a limited lifetime, so you do not have to rotate them or explicitly revoke them when they’re no longer needed.

After temporary security credentials expire, they cannot be reused (you can specify how long the credentials are valid for, up to a maximum limit)

67
Q

Where do users come from?

A

Federation (typically AD):
Uses SAML 2.0.
Grants temporary access based on the users AD credentials.
Does not need to be a user in IAM.
Single sign-on allows users to login to the AWS console without assigning IAM credentials.

Federation with Mobile Apps:
Use Facebook/Amazon/Google or other OpenID providers to login.

Cross Account Access:
Allows users from one AWS account access resources in another.
To make a request in a different account the resource in that account must have an attached resource-based policy with the permissions you need.
Or you must assume a role (identity-based policy) within that account with the permissions you need.

68
Q

IAM Best Practices Summary

A

Lock away the AWS root user access keys.

Create individual IAM users.

Use AWS defined policies to assign permissions whenever possible.

Use groups to assign permissions to IAM users.

Grant least privilege.

Use access levels to review IAM permissions.

Configure a strong password policy for users.

Enable MFA.

Use roles for applications that run on AWS EC2 instances.

Delegate by using roles instead of sharing credentials.

Rotate credentials regularly.

Remove unnecessary credentials.

Use policy conditions for extra security.

Monitor activity in your AWS account.

AWS Cloud Practitioner (Digital Cloud) (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions