IAM Flashcards
How to choose an AWS Region? (4) (CAPP)
Compliance, Available services, Proximity, Pricing
data never leaves a region without your explicit permission (How to choose an AWS Region?)
Compliance with data governance and legal requirements
reduced latency (How to choose an AWS Region?)
Proximity to customers
new services and new features aren’t available in every Region (How to choose an AWS Region?)
Available services within a Region
pricing varies region to region and is transparent in the service pricing page (How to choose an AWS Region?)
Pricing
What does IAM stand for?
Identity and Access Management
What type of service is IAM
Global
IAM Policies Structure consist of _____? (3) (VIS)
Version, Id, Statement
IAM Policies Structure - policy language version, always include“2012-10- 17”
Version
IAM Policies Structure - identifier for the policy (optional)
Id
IAM Policies Structure - you can have one or more (required)
Statements
IAM Policies Structure Statements consists of _____? (6) (SPEARC)
Sid, Principal, Effect, Action, Resource, Condition
IAM Policies Structure Statements - whether the statement allows or denies access (Allow, Deny)
Effect
IAM Policies Structure Statements - account/user/role to which this policy applied to
Principal
IAM Policies Structure Statements - list of ________ this policy allows or denies
Action
IAM Policies Structure Statements - a list to which the actions applied to
Resource
IAM Policies Structure Statements - an identifier for the statement (optional)
Sid
IAM Policies Structure Statements - when this policy is in effect (optional)
Condition
What does MFA stand for?
Multi factor Authentication
MFA devices options in AWS? (4)
Virtual MFA device
Universal 2nd Factor (U2F) Security Key
Hardware Key Fob MFA Device
Hardware Key Fob MFA Device for AWS GovCloud (US)
What does SDK stand for?
Software Development Kit
2 IAM Security Tools that help monitor users
IAM Credentials Report (account-level)
IAM Access Advisor (user-level)
- Shows the service permissions granted to a user and when those services were last accessed.
- You can use this information to revise your policies.
IAM Access Advisor (user-level)
A report that lists all your account’s users and the status of their various credentials
IAM Credentials Report (account-level)
mapped to a physical user, has a password for AWS Console
Users
contains users only
Groups
JSON document that outlines permissions for users or groups
Policies
for EC2 instances or AWS services
Roles
MFA + Password Policy
Security
manage your AWS services using the command-line
AWS CLI
manage your AWS services using a programming language
AWS SDK
access AWS using the CLI or SDK
Access Keys
IAM Credential Reports & IAM Access Advisor
Audit
