IAM

Question 1

What is the SID of a policy statement?

Answer 1

SID = Statement ID. This is an optional identifier for the policy statement.

Question 2

What is the effect of a policy statement?

Answer 2

effect is set to allow or deny in order to grant access or deny access to a specific resource or action.

Question 3

What is the resource of a policy statement?

Answer 3

Names a resource that the statement applies to.

Question 4

What is the action of a policy statement?

Answer 4

Names the action that the policy statement applies to.

Question 5

How does AWS decide on priority in a policu?

Answer 5

DENY ALLOW DENY. First, deny access to things explicitly denied. Then, allow things explicitly allowed. Finally, deny things that aren’t explicitly allowed.

Question 6

What’s the difference between inline and managed policies?

Answer 6

Inline policies are directly assigned to users, managed policies are objects that can be applied to several different users. Managed policies are the way to go!

Question 7

How many IAM users are permitted in one AWS accounr?

Answer 7

5,000

Question 8

How many groups can an IAM user be a part of?

Answer 8

10

Question 9

What is an IAM Group used for?

Answer 9

Containers for users, mostly for admin purposes. You can also attach policies to groups.

Question 10

How many groups allowed per AWS account?

Answer 10

300

Question 11

What is the limit to the number of groups a user can belong to?

Answer 11

None ;)

Question 12

What is a Role?

Answer 12

Roles are IAM identities that can be assumed by a principal with AWS.

Question 13

What is a Trust policy?

Answer 13

A policy assigned to roles that can reference identities or AWS services that generate temporary security credentials.

Question 14

What is a Permissions policy?

Answer 14

A permissions policy is checked by the temporary security credentials generated by a Trust Policy to allow access to services.

Question 15

Name a few scenarios where using roles might be beneficial.

Answer 15

• Application access or script running
• Break the glass scenario
• Greater than 5,000 users
• Interacting with another AWS account without needing to create 1000s of users in another account

Question 16

What is the main purpose of AWS Organizations?

Answer 16

Allows large companies to manage multiple AWS accounts

Question 17

What is the Management Account?

Answer 17

The AWS account that creates the organization.

Question 18

What is consolidated billing?

Answer 18

A system in AWS Organizations in which costs from the management account + member accounts are all consolidated under the management account. Results in volume discounts.

Question 19

What is role switch used for?

Answer 19

Switching into another AWS account within the same organization.

Question 20

What is a service control policy?

Answer 20

A policy that can be attached to an organization. Except for users under management account, restricts what any user can do (even root user!)