Course Fundamentals and AWS Accounts

Question 1

AWS Account

Answer 1

An AWS Account is a container for identities (users) and resources

By default all access to an AWS Account & resources is denied except for the Account Root User

All external identities are denied by default but can be granted access

Question 2

AWS Multi-Factor Authentication (MFA)

Answer 2

Is a simple best practice that adds an extra layer of protection on top of your user name and password.

Question 3

Identity and Access Management

Answer 3

IAM is a globally resilient service, so any data is always secure across all AWS regions

• IAM is what allows additional identities to be created within an AWS account - identities which can be given restricted levels of access.
• No cost
• Identity federation and MFA

Question 4

IAM Basics

Answer 4

IAM identities start with no permissions on an AWS Account, but can be granted permissions (almost) up to those held by the Account Root User.

It’s always best practice to only give the permissions required to do a job, or perform a task = this is called Least Privileged Access

Question 5

IAM lets you create three different types..

Answer 5

• IAM User: Identities which represent humans or applications that need access to your account. (when you can identify the individual thing that will log in with that user, so if it’s an individual person or individual application, then generally you’ll use users.)
• IAM Groups: Colletion of related users
• IAM Roles: Can be used by AWS Services, or for granting external access to your account. Roles tend to get used when the number of things is uncertain, so if you want to grant users of external accounts access to say a simple storage service bucket, or an uncertain number of EC2 instances access to certain services in your account, or allow AWS services themselves to interact on your behalf, then you’ll generally use a role.

Question 6

IAM Policy

Answer 6

IAM let’s you create these policies which are essentially objects or documents which can be used to allow or deny access to AWS services, only when they’re attached to IAM Users, Groups, or Roles.

Question 7

IAM has 3 main jobs..

Answer 7

• Manages Identities - An ID Provider (IDP)
• Authenticates Identities: Prove you are who you claim to be
• Authorizes Identities: Allow or deny access to resources

Question 8

Account Root User

Answer 8

It’s not possible to restrict the Account Root User, you can’t delete it or recreate it, we should almost NEVER use it.

Question 9

Access Keys

Answer 9

Are long-term credentials available within AWS and are with by IAM users

• Access keys are formed from two parts, Access Keys ID and Secret Access Key (There’s no ability to get access again)
• An IAM users can have two access keys (no more)
• Access keys can be created, deleted, made inactive or made active (default)

Question 10

Commands with AWS CLI

Answer 10

• aws –version = to see the CLI version that you installed
• aws configure –profile USER-NAME = to configure a profile that will have an access keys
• aws s3 ls –profile USER-NAME = to see if the profile has any S3 buckets created