IAM Flashcards
What does IAM stand for?
Identity and Access Management
Name
4 IAM Key Components
- Users
- Groups
- Roles
- Policies
Is IAM a Regional Service?
No, IAM is a Global Service.
Meaning it is available in every Region
Define
Root Account
The default account for an organization.
What should you use the Root Account for?
Setting up the AWS Account
Should not be shared or used for anything else.
Define
Users
People within your organization that receive permissions
Define
Groups
A way of defining similar permissions for multiple users
What can be added to a Group?
Only Users
You can’t add another Group to a Group
Can a User belong to multiple Groups?
Yes
Does a User have to have a Group?
No
Define
Policies
JSON documents the define permissions for a certain User or Group
Define
Least Privilege Principle
A User/Group should recevie the minimum permissions possible to perform their function
Name
3 Elements of a Policy JSON
- Version policy language version
- Id identifier for the policy
- Statement one or more permissions to be granted
Name
6 Elements of a Policy JSON Statement
- Sid indentifier for the statement
- Effect whether the statement allows or denies access
- Principal account/user/role to which this policy is applied
- Action list of actions this policy allows or denies
- Resource list of resources to which the actions applied to
- Condition conditions for when this policy if in effect
Define
Sid
Policy JSON Statment Element
Identifier of the statement
Ex:"Sid": "1"
Define
Effect
Policy JSON Statment Element
Whether the Statement allows or denies access.
Values are “Allow”, “Deny”
Ex."Effect": "Allow" or "Effect: "Deny"
Define
Principal
Policy JSON Statment Element
Account/User/Role to which this policy is applied to.
Ex."Principal": { "AWS": ["arn:aws:iam::12345678901:root"] }
Define
Action
Policy JSON Statment Element
List of actions this policy allows or denies
Ex."Action": [ "s3:GetObject", "s3:PutObject" ]
Define
Resource
Policy JSON Statment Element
List of resources to which the actions are applied to
Ex."Resource": [ "arn:aws:s3:::mybucket/*" ]
Define
Condition
Policy JSON Statment Element
Conditions for when this policy is in effect
Ex."Condition" : { "StringEquals" : { "aws:username" : "johndoe" } }
Which Policy JSON Elements are optional?
- Id
- Sid
- Condition
Define
IAM Password Policy
Specific requirments defined by the Root user for User passwords.
Name
5 Possible restrictions set by Password Policy
- Minimum length
- Specific Character Types
- Users can change their passwords
- Expiration
- Password Re-Use
Name
4 Character Types that can be required by the Password Policy
- Uppercase
- Lowercase
- Numbers
- Non-Alphanumeric
Define
MFA
Multi-Factor Authentication combines a password you know with a device you own
If your password is stolen, the account is not compromised
Name
4 Authorized MFA devices for AWS Accounts
- Virtual MFA application that stores tokens for authentication
- Universal 2nd Factor (U2F) Security Key physical device with a single security key (USB)
- Hardware Key Fob Physical device with a display that has a random changing token
- Hardware Key Fob for AWS GovCloud US Government use
Name
3 Ways a User can Access AWS
- AWS Management Console protected by password + MFA
- AWS Command Line Interface (CLI) protected by access keys
- AWS Software Development Kit (SDK) protected by access keys
Define
Access Key
A Long-term credential for an IAM User, used to sign requests to the AWS CLI or SDK
Name
2 Parts of an Access Key
- Access Key ID
- Secret Access Key
How are Access Keys generated?
Through the AWS Management Console
Who manages Access Keys?
The User manages their own Access Keys.
Define
AWS CLI
Command line tool that enables a user to interact with AWS services from their local shell
Direct alternative to the AWS Management Console
Define
AWS Software Development Kit (SDK)
Language-specific APIs that enable a user to access and manage AWS services programmatically
Emebedded within your application
Name
5 Environments Supported by AWS SDK
- Web
- Cloud
- Mobile
- IoT
- Gaming
Define
IAM Role
A set of Permissions assigned to an AWS Service to perform actions on your behalf
Name
2 IAM Security Tools
- IAM Credentials Report (account-level)
- IAM Access Advisor (user-level)
Define
IAM Credentials Report
Lists all your account’s users and the status of their various credentials
Define
IAM Access Advisor
Shows the service permissions granted to a user and when those services were last accessed
Useful for revising IAM Policies
