AWS Solutions Architect Associate 2025 Flashcards
To learn and retain more about AWS
What is an IAM role?
Entities you create and assign specific permissions to that are assumed by trusted identities such as workforce identities and applications to perform actions in AWS. Roles are temporary and do not have long term credentials.
What is an IAM policy?
An IAM policy is a JSON document in AWS that defines permissions for identities (users, groups, roles) or resources. It specifies what actions (e.g., s3:PutObject) are allowed or denied, on which resources (e.g., arn:aws:s3:::example-bucket/*), and under what conditions (optional). Policies can be identity-based (attached to users, groups, or roles), resource-based (attached to resources like S3 buckets), managed (predefined by AWS or custom reusable policies), or inline (specific to one identity). They are essential for controlling access to AWS resources and enforcing the principle of least privilege.
What does IAM stand for?
AWS Identity and Access Management
What is an IAM user?
An IAM identity that you create in AWS representing the human, workload or application, that interacts with AWS. Users have credentials (access keys for APIs/CLI, passwords for the console) and are granted permissions via policies.
What is a root user?
When you first create an Amazon Web Services (AWS) account, you begin with a single sign-in identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account root user and is accessed by signing in with the email address and password that you used to create the account. The root user has special privileges like the ability to enable MFA or close the aws account.
It’s bad practice to use the root user for any actions.
How can you identify an IAM user?
• a freindly name (e.g. John)
• An ARN (an Amazon Resource Name)
• a unique identifier
How might an IAM role and IAM user interact?
A user might assume an IAM role temporarily.
How might an IAM user be used? What does it identify?
Typically, to identify a human. It can also be used to ID an application, but using an IAM role is more appropriate for enhanced security.
Can you assign an IAM role to an IAM user?
Yes.
What kinds of IAM policies are there?
Types of IAM Policies
1. Identity-Based Policies
• Attached to users, groups, or roles.
• Define what actions the identity can perform on AWS resources.
2. Resource-Based Policies
• Attached directly to resources (e.g., S3 buckets, KMS keys).
• Specify who can access the resource and what actions they can perform.
3. AWS Managed Policies
• Predefined by AWS for common use cases.
• Cannot be edited but can be attached to identities.
4. Customer Managed Policies
• Custom reusable policies created by you.
• Offer flexibility for specific permissions.
5. Inline Policies
• Embedded directly in a user, group, or role.
• Used for specific, tightly scoped permissions.
6. Permissions Boundaries
• Define the maximum permissions an identity-based policy can grant.
• Acts as a guardrail for roles or users.
7. Session Policies
• Temporary, inline policies passed when assuming a role or federating.
• Restrict permissions for the duration of a session.
What are identity based IAM policies?
Identity-based policies are JSON permissions policy documents that control what actions an identity (users, groups of users, and roles) can perform, on which resources, and under what condition. They are attached to an IAM identity.
What are resource based IAM policies?
Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. These policies grant the specified principal permission to perform specific actions on that resource and defines under what conditions this applies. Resource-based policies are inline policies
What are IAM permissions boundaries?
A permissions boundary is an advanced feature in which you set the maximum permissions that an identity-based policy can grant to an IAM entity.
What are service control policies?
SCPs are JSON policies that specify the maximum permissions for an organization or organizational unit (OU).
What are access control lists?
Access control lists (ACLs) are service policies that allow you to control which principals in an account can access a resource.
They are more straightforward and less flexible than resource based policies, but they are easier to do .
They are largely deprecated and are limited: For example, you can grant permissions only to other AWS accounts; you cannot grant permissions to users in your account. You cannot grant conditional permissions, nor can you explicitly deny permissions. ACLs are suitable for specific scenarios. For example, if a bucket owner allows other AWS accounts to upload objects, permissions to these objects can only be managed using object ACL by the AWS account that owns the object.
What are session policies?
Session policies are advanced policies that you pass as a parameter when you programmatically create a temporary session for a role or federated user.
