IAM 101 Flashcards
Users
End Users
Groups
Collection of users under one set of permissions (or policies)
Roles
You create roles and assign them to AWS resources
Does IAM give you centralized control of your AWS account?
yes
Does IAM provide shared access to your AWS account?
yes
Does IAM provide granular permissions
yes
Does IAM provide identity federation to connect to Active Directory, Facebook, LinkedIN, etc.?
yes
Does IAM provide temporary access for users/devices if needed?
yes
Does IAM let you create & customize your own password rotation policy?
yes
Does IAM support PCI DSS compliance?
yes
Policies (Policy Documents)
document that defines one or more permissions. Attach policies to users, groups or roles
How do you apply a policy?
Attach policies to users, groups or roles
Policy Documents
Apply to users, groups, roles
made up of JSON
key-value pair: attribute and value (version:date) (effect:allow) (action:*)
Is IAM universal (global)
yes
it doesn’t apply to regions at this time
user, group or role is consistent across all regions
root account
the account created when first setting up your AWS account
Only account that has complete admin access by default
What permissions do new users have when first created?
none
What two things are new users assigned when first created (for programmatic access)
Access Key ID
Secret Access Keys
Can you use the Access Key ID and SecretAccess Key to log in to the console?
No.
You need a password to login to the console
You can only use these to access from the CLI or via API’s
How many times can you view the Access Key ID & SecretAccess Key?
Once. Can download them to CSV
If you lose them, you have to regenerate them
Setup MFA on root account
Otherwise get warnings
When do you use the Access key ID and Secret Access Key?
When programmatically accessing AWS
cannot use username and password for this
Examples of IAM Roles
IAM user in other account
Code running on EC2 instance that acts on AWS resources
AWS Service that acts on your resources
Users in directory linked with SAML for federation
What’s special about role keys
they’re valid for short durations
