Basics Flashcards
What is an availability zone
It’s basically a data center or a group of them
What is a Region
It is a distinct physical area with two or more availability ZOne
What is an Edge Location?
It a smaller location used to supplement region mostly to cache content. There are more edge locations than regions Example: CloudFront and Amazons Content Delivery Network
key terminologies for IAM
Users, Groups, Policies and Rules
What is root account
its the email address we signed up with
explain User ,role, group and permissions
Users:
Are the users we create, as such they don’t have any permissions.
Groups and Roles:
Users can belong to multiple groups and roles.
Permissions:
These are policies we attach to role or Group, for example S3 full access or ec2 full admin.
How to stop an account from going over a threshold
Use Billing alarm inside cloudwatch
Standard way to create users
1) Create users with least privilege
2) Give them security credentials
3) Add them to a group and manage permissions for the group.
4) Optionally give them Login profile.
What are the IAM entities?
Users, roles and groups. Permissions can be given to these entities to access resources
How are permissions given to entities?
Permissions are given in terms of Policies. Policies contain Resource,Action,conditions and effect.
What are IAM roles?
They allow delegating access to users who normally don’t have access to the resources. Normally Ec2 inctances when they connect to other services, they will have to sign the request with credentials, which is cumbersome to manage for many instances.Thats where roles come in. Roles can be created separately with policies to enable access to services(like S3) and we can attach roles to Ec2 instances.When this happens the Ec2 instances will be provided with access id and Token from the metadataservice and they can communicate with teh intended services.
How to create an EC2 instance with a role, having access to S3
1) Create a role.
2)Attach a readonly policy to s3 for that role.
3)Launch an Ec2 instance and select this newly created role from teh launch wizard.
Now this Ec2 instance has readonly access to the s3 bucket. Basically a temp access key and token are provided to the EC2 inctance to achieve this.
What are the security services available in AWS
IAM,KMS(Key management service),Cognito, WAF
What is a Prinicipal in IAM?
It could be a user or a role
