IAM

Question 1

What types of policies are there?

Answer 1

• Inline policies - JSON attached to resource.
• Managed Policies - reusable json with a name.
• Resource Policies - can be assigned only to service resource. Checks specific identities can allow or deny access. Always have principal component.
• Permission Policies - Allow or deny access to use a specific resource
• Identity Policies - can be attached only to identities
• Trust Policies - Specifies which identities can assume the role.

Question 2

What are parts of the policy?

Answer 2

Statement:
- SID
- Resource
- Action
- Effect
- Principal - determines which identites can use the policy

Question 3

How overlapping policies and statements work?

Answer 3

1. Explicit deny
2. Explicit allow
3. Implicit deny

Question 4

What is authentication and authrorization?

Answer 4

Authentication - verifies the identity
Authorization - determines access rights

Question 5

How many iam users can be created per account?

Answer 5

5000

Question 6

How many groups can be added to each user?

Answer 6

10

Question 7

What is ARN?

Answer 7

Amazon Resource Name” uniquely identify resources within any AWS accounts

Question 8

How many groups can be created?

Answer 8

soft limit - 300

Question 9

How roles work?

Answer 9

There are 2 policies:
- Trust policy - determines who can assume the role
- Permission policy - what permissions this identity have

Generate temperature security credentials therefore don’t combine actual identities permissions with roles permissions.

Question 10

What is role separation?

Answer 10

Role seperation is mehanics that allows different identity to have different permissions to operate with resource. For example administrative, encrypt, decrypt.

Question 11

What are service linked roles?

Answer 11

Service creates role for himself which allow interacting with other AWS services. User cannot change or delete the role.

Question 12

What is break glass situation?

Answer 12

A user with no permissions assumes role that have required permissions to execute some action.
When user have not assumes the role, he is protected by accidentally executing something.

Question 13

How external identities interact with AWS?

Answer 13

They must assume Role or use an iam identity to interact with services.

Question 14

What is identity federation?

Answer 14

External identities assume a role in aws - for example SAML, google, facebook.