IAM 101 Flashcards
What is IAM?
Identity and Access Management
What is a root account? What should it be used for?
An IAM root account is created when you create an AWS account. It will always have full permissions for your organization, so it should only be used to create users.
How are users organized within an organization?
By GROUPS, which are collections of users.
How many groups can a user belong to?
They can belong to multiple groups, but a user doesn’t need to belong to any groups.
Can a group contain other groups?
No, a group can only contain users.
How are IAM permissions determined?
Users or groups can be assigned JSON documents called POLICIES, which define its permissions.
You are concerned about passwords being cracked or stolen within your organization. What are two ways to mitigate the risk of this?
1) You can create a password policy that specifies password length, password re-use requirements, character types, or password expiration periods.
2) You can enforce MFA.
What are the options for MFA?
1) A virtual MFA device like Google Authenticator or Authy.
2) A hardware U2F device like YubiKey.
3) A hardware key fob MFA device like Gemalto.
4) A hardware key fob MFA device for AWS GovCloud, like SurePassID.
What is the difference between a MFA device and a U2F device?
MFA is support for multiple tokens on a single device, while U2F (a “universal” key) is a single key for multiple root and IAM users.
If you don’t have access to a shell for AWS (or can’t install the CLI tool), what’s another option for using the CLI?
AWS has a browser CLI called CloudShell. It has the same credentials that you’d use for your user.
How can you give permissions to an AWS service?
Create an IAM role.
What is an IAM role?
You can think of an IAM role as similar to an IAM user, but intended to be used by an AWS service.
You’d like to do an account-level audit of your users’ credentials. What security tool would you use?
IAM Credentials Report.
It lists all of your account’s users and the status of their various credentials.
You’re worried that a user could have IAM access to a service that they don’t need. How can you examine this, and see if that permission has been used?
IAM Access Advisor.
It shows the permissions granted to a user and when those services were last accessed.
What is an access key?
An access key is used for programmatic (CLI/SDK) access to AWS. It’s similar to a machine user in CircleCI. You can only have two access keys.
