AWS Security (IAM) Flashcards
What are the 4 steps to secure your AWS root account?
- Enable multi-factor authentication on the root account.
- Create an admin group for your administrators, and assign the appropriate permissions to this group.
- Create user accounts for your administrators.
- Add your users to the admin group.
How do we control permissions using IAM?
We assign permissions using policy documents, which are made up of JSON (JavaScript Object Notation).
Permissions are stored using what format?
JSON
A policy document consists of what sections?
- Version
2. Statement
What kind of IAM Policy Documents are there?
Groups, Users & Roles
Does IAM require the region to be selected?
No.
What are the types of IAM Policies?
AWS Managed & Customer Managed
In the policy document, typically what are the 3 sections under Statement?
Effect, Action and Resource
What are the 3 building blocks for Identity & Access Management?
- Users - a physical person
- Groups - functions, such as administrators, developers, etc. Groups contain users.
- Roles - internal usage within AWS
It is best practice for users to ______ permissions from groups.
inherit
What’s the best practice in regards to users and people?
1 user = 1 person.
Always work on the principle that one user equals one physical person. Never share user accounts across multiple people.
Should you share user accounts across multiple people?
No. It is not considered best practice.
What is the definition of “The Principal of Least Priviledge”?
Only assign a user the minimum amount of privileges they need to do their job.
Where do you set password policy requirements?
Under “Account Settings” in IAM.
When you create a user, what kind of permissions are they automatically granted?
A new user is created with NO PERMISSIONS by default.
You can add an ______ ______ to establish a trust between SAML 2.0 and other services’ logins.
Identity provider
What makes your windows login useable within AWS, using the Identity Provider using SAM?
Active Directory Federation
What is the account that is created when you first set up your AWS accounts and which has complete access?
Root account
What account should you secure as soon as possible AND not use to log in day to day?
Root account
Are access key ID and secret access keys the same as usernames and passwords?
No. You cannot use the access key ID and secret access key to login to the console. You can use them to access AWS via the APIs and Command Line.
What do you use to access the login to the console?
IAM user account
What do you use to access AWS via the APIs and Command Line?
Access Key ID and Secret Access Key
True or False: If you lose the access key ID and secret access key values, you can download the existing ones from the console as an administrator.
False.
You only get to view these once. You’ll have to regenerate them if you lose them. Save them in a secure location.
You can use this to combine your existing user account with AWS. For example, Microsoft Active Directory credentials can be used if you setup this service.
IAM Federation
What uses the SAML standard, which is Active Directory?
Identity Federation
Always give your users the _____________ of access required to do their job.
minimum amount
Create ________ and assign your users to them.
“1. Create IAM groups and assign your users to groups.
- Group permissions are assigned using IAM policy documents.
- Your users will automatically inherit the permissions of the group.”
What is an IAM Role?
A role is an identity you can create in IAM that has specific permissions. A role is similar to a user, as it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS.
True or False: A role is uniquely associated with one person.
False. Instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it.
A role does/does not have the same standard long-term credentials the same way passwords or access keys do.
“Does not.
Instead, when you assume a role, it provides you with the temporary security credentials for your role session.”
Roles can allow ______ access.
Cross-Account access. This allows one AWS account the ability to interact with resources in other AWS accounts.
What other entities can assume a role?
People, AWS architecture, or other system-level accounts.
When using roles, the preferred option is:
Roles are preferred from a security perspective.
True or False: Always choose using roles over hard-coding your credentials.
True. Roles allow you to provide access without the use of access key IDs and secret access keys.
Roles require / do not require the use of access key IDs and secret access keys.
DO NOT require
How is a role’s permissions being controlled?
By using policies.
Upon updating a policy attached to a role, it will take effect when?
Immediately
