IAM Flashcards
What does an IAM identity represent?
- User
- Role
What is an IAM role?
An IAM role is an identity that can be temporarily assigned to an application, service, user, or group.
Can users or applications without AWS accounts be authenticated and given temporary access to AWS resources?
Yes, through federation with an external service, such as Kerberos, AD, or LDAP.
How are identities pricisely controlled to access specific AWS resources?
By attaching policies.
What the two ways to attach IAM policies?
- To IAM identity (identity-based policy)
- To resource (resource-based policy)
What does the IAM Policy look like?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["*"],
"Resource": ["*"]
}
]
}How does IAM Policy work?
- Any action that’s not explicited allowed by a policy will be denied.
- “Deny” policy always wins when there’s a conflict.
What is a IAM group?
IAM group helps to manage policies for a group of IAM users.
What happens when a trusted entity assumes a role?
AWS issues it a time-limited security token using the AWS Security Token Service (STS)?
What are two important functions of Amazon Cognito?
- User pool (add user sign-up and sign-in to your application)
- Identity pool (give application users temporary, controlled access to other services in your AWS account)
How to integrate with AD on-premise in AWS?
Use AWS Directory Service.
The goal is to apply Active Directory domains to compatible applications running in your VPC.
What is AWS Organizations?
AWS Organizations can manage policy-based controls across multiple AWS accounts.
What is AWS Secrets Manager?
AWS Secrets Manager manages passwords and 3rd party API keys and deliver them to applications on request.
The manager will even automatically take care of credential rotation.
What is AWS CloudHSM?
CloudHSM provides a encryption-key management service that’s similar to AWS KMS, but can meet certain compliance requirements (e.g. FIBS 140-2).
What is the best practice with AWS root account?
- Lock down root user
- Delegate day-to-day tasks to specially defined users
