AWS Security Flashcards
Who is responsible for keeping AWS resources secure?
Both the customer and AWS are responsible for keeping AWS resources secure.
What are the customer’s responsibilities in the shared responsibility model?
The customer is responsible for the security of everything that they create and put in the AWS Cloud. This includes selecting, configuring, and patching the operating systems that will run on Amazon EC2 instances, configuring security groups, and managing user accounts.
What are AWS’s responsibilities in the shared responsibility model?
AWS is responsible for the security of the cloud. This includes areas such as the host operating system, the virtualization layer, and even the physical security of the data centers from which services operate. AWS also manages the security of the cloud, specifically the physical infrastructure that hosts your resources.
What are some examples of customer responsibilities in the shared responsibility model?
Some examples of customer responsibilities in the shared responsibility model include:
Selecting and configuring the operating system for Amazon EC2 instances
Configuring security groups
Managing user accounts
Encrypting data
Implementing security best practices
Monitoring and auditing your environment
What are some examples of AWS responsibilities in the shared responsibility model?
Providing secure infrastructure
Protecting the physical security of data centers
Operating and maintaining the cloud
infrastructure
Updating and patching software
Monitoring the cloud environment for security threats
Responding to security incidents
What is the difference between security in the cloud and security of the cloud?
Security in the cloud refers to the security of the customer’s data and applications that are hosted in the AWS Cloud. This includes things like selecting and configuring the operating system, configuring security groups, and managing user accounts. Security of the cloud refers to the security of the AWS infrastructure that hosts the customer’s data and applications. This includes things like the physical security of data centers, the hardware and software infrastructure, and the network infrastructure.
What are some of the benefits of the AWS shared responsibility model?
Reduced operational overhead: The customer does not have to worry about the day-to-day management of the physical infrastructure. This can save the customer time and money.
Increased security: AWS has a team of security experts who are responsible for the security of the cloud infrastructure. This means that the customer can be confident that their data is secure.
Flexibility: The AWS shared responsibility model gives the customer flexibility in how they manage the security of their data and applications. The customer can choose the level of security that is right for their needs.
What are some of the challenges of the AWS shared responsibility model?
The customer must be aware of their responsibilities: The customer must understand their responsibilities in the shared responsibility model. If the customer does not understand their responsibilities, they may not be able to protect their data and applications.
The customer must be able to manage their security: The customer must be able to manage the security of their data and applications. This includes things like configuring security groups, managing user accounts, and encrypting data.
The customer must be able to monitor their environment: The customer must be able to monitor their environment for security threats. This includes things like monitoring for unauthorized access, malware, and data breaches.**
What is an IAM user?
An IAM user is an identity that you create in AWS. It represents the person or application that interacts with AWS services and resources.
What is the root user?
The root user is the first user created in an AWS account. It has full access to all AWS services and resources in the account.
What is an IAM role?
An IAM role is an identity that you can assume to gain temporary access to permissions. It is often used to grant access to AWS services and resources to applications or services.
What is AWS Identity and Access Management (IAM)?
IAM is a service that helps you manage access to AWS services and resources. It allows you to create and manage users, groups, and roles, and to control their permissions.
What is an IAM group?
An IAM group is a collection of IAM users. When you assign an IAM policy to a group, all users in the group are granted permissions specified by the policy.
What are some best practices for IAM?
Do not use the root user for everyday tasks.
Create individual IAM users for each person who needs to access AWS.
Follow the principle of least privilege when granting permissions.
Use IAM groups to manage permissions.
Enable MFA for the root user and all IAM users.
Rotate IAM user credentials regularly.
Monitor IAM activity for suspicious activity.**
What is the purpose of AWS Identity and Access Management (IAM)?
AWS Identity and Access Management (IAM) enables the secure management of access to AWS services and resources.
What is multi-factor authentication (MFA)?
MFA is an extra layer of security that requires users to provide two or more pieces of information to verify their identity when signing in to AWS.
What are the features explored in detail in relation to IAM?
The features explored in detail in relation to IAM are IAM users, groups, and roles, IAM policies, and multi-factor authentication.
What is the role of the AWS Account Root User?
The AWS Account Root User is the initial identity created when an AWS account is set up. It has complete access to all AWS services and resources in the account.
What is the recommended best practice regarding the use of the AWS Account Root User?
The recommended best practice is to not use the root user for everyday tasks. Instead, create an IAM user and assign appropriate permissions for regular tasks.
How are permissions granted to an IAM user?
By default, a newly created IAM user has no permissions associated with it. Specific permissions need to be granted to the IAM user to perform actions in AWS.
What is an IAM user in AWS?
An IAM user is an identity created in AWS for individuals or applications to interact with AWS services and resources. It consists of a name and credentials.
What is an IAM policy?
An IAM policy is a document that grants or denies permissions to AWS services and resources. It allows customization of users’ access levels to resources.
What security principle should be followed when granting permissions in IAM policies?
The security principle of least privilege should be followed, granting users or roles only the permissions necessary to perform their tasks.
How are IAM policies used in granting access to specific resources?
IAM policies specify the allowed actions and resources for a user. For example, an IAM policy can grant access to a specific Amazon S3 bucket.
What is the purpose of IAM groups?
IAM groups are collections of IAM users. When an IAM policy is assigned to a group, all users in the group are granted the permissions specified by the policy.
What is the advantage of using IAM groups in managing permissions?
Assigning IAM policies at the group level makes it easier to adjust permissions when an employee changes roles. Users can be added or removed from groups to grant or revoke permissions.
What are IAM roles in AWS?
IAM roles are identities that can be assumed to gain temporary access to permissions. They are ideal for situations where temporary access is needed.
What is the purpose of multi-factor authentication (MFA) in IAM?
Multi-factor authentication (MFA) provides an additional layer of security for AWS accounts. It requires users to provide multiple forms of verification to access the account.
How does MFA work in IAM?
Users enter their IAM user ID and password, and then provide an authentication response from their MFA device, such as a hardware key or smartphone application.
What is the recommended best practice regarding MFA in AWS?
It is recommended to enable MFA for both the root user and IAM users in order to enhance the security of the AWS account and protect against unauthorized access.
What are the default permissions for a new IAM user?
By default, a new IAM user has no permissions associated with it. This means that the user cannot perform any actions in AWS, such as launching an Amazon EC2 instance or creating an Amazon S3 bucket.
What can a user with the default IAM policy do?
Sign in to the AWS Management Console
Change their password
Access their user information
What is AWS Organizations?
AWS Organizations is a service that helps you consolidate and manage multiple AWS accounts within a central location.
What is a root in AWS Organizations?
A root is the parent container for all the accounts in your organization.
What are service control policies (SCPs)?
SCPs are a type of policy that you can use to centrally control permissions for the accounts in your organization.
What is the purpose of AWS Organizations?
AWS Organizations allows the consolidation and management of multiple AWS accounts within a central location.
How can permissions be centrally controlled for accounts in AWS Organizations?
Permissions for accounts in AWS Organizations can be centrally controlled using service control policies (SCPs). SCPs restrict access to AWS services, resources, and API actions for users and roles in each account.
What is the role of consolidated billing in AWS Organizations?
Consolidated billing is a feature of AWS Organizations that enables the billing of multiple accounts under a single payment method. It simplifies billing and provides a comprehensive view of costs across the organization.
