IAM

Question 1

What is IAM Users

Answer 1

Identities used for anything that requires long-term AWS access
Ex: humans, application or service accounts

Question 2

IAM Users numbers limitation

Answer 2

5000 IAM Users per Account
1 IAM Users can belong to 10 Groups

Question 3

IAM User is authenticated by what?

Answer 3

• Username & Password (+MFA)
• Access Key (CLI, SDK)

Question 4

IAM User is authorized for access based on what?

Answer 4

IAM policy
Attached or embedded in IAM User

Question 5

IAM User should not used for…

Answer 5

• Internet-scale app
• Large organizations

Question 6

What is IAM Group?

Answer 6

Collection of related IAM User

Question 7

When to use IAM Group?

Answer 7

• Used for organizing IAM User
• Cannot contain other Groups

Question 8

IAM Group numbers limitation

Answer 8

• 300 IAM Groups per Account
• Can be increased

Question 9

IAM Group isn’t a true identity, therefore…

Answer 9

… cannot be referenced by a Resource policy

Question 10

When to use IAM Role?

Answer 10

• Uncertain number of principals
• Need access in a short period of time

Question 11

IAM Role is a true identity, therefore…

Answer 11

… can be referenced by a Resource policy

Question 12

What is Temporary Security Credentials?

Answer 12

• Generated by Secure Token Service
• Assigned to the principal who is assuming the Role
• Has expiration
• Affected by Permission policy

Question 13

What is the effect of a Trust Policy

Answer 13

Controls which identities can assume the Role

Question 14

What is the effect of a Permission Policy

Answer 14

Controls which resources the Role can access to, also called Identity Policy

Question 15

Difference between Service-linked Role and IAM Role

Answer 15

Service-linked Role cannot be deleted manually during the service usage

Question 16

What is IAM Policy?

Answer 16

• Sets of security statements
• Granting or deny access to AWS products for an identity

Question 17

What is Sid in IAM Policy?

Answer 17

• Statement ID
• Meaning what the statement does
• Optional, recommended

Question 18

Example of Actionin IAM Policy?

Answer 18

• “Action”: “ec2:StartInstances”
• “Action”: “s3:GetObject”
• “Action”: “s3:*”

Question 19

Example of overlapped IAM Policy Statements

Answer 19

1st statement Allow full access to an S3 bucket but 2nd statement Deny the access to its internal buckets

Question 20

Priority if the IAM Policy Statements are overlapped

Answer 20

Explicit Deny, then Explicit Allow, then Implicit Deny (default)

Question 21

IAM Policy Types

Answer 21

• Managed Policy (recommended: reuseable, low managed)
• Inline Policy (used for special cases)