IAM

Question 1

Request context of a policy

Answer 1

Principal
action
Resource,

Question 2

Policy Types

Answer 2

identity-based policies,
resource-based policies,
IAM permissions boundaries,
AWS Organizations service control policies (SCPs),
access control lists (ACLs),
session policies

Question 3

Identity based

Answer 3

Also known as IAM policies, identity-based policies are managed and inline policies attached to IAM identities (users, groups to which users belong, or roles).

Question 4

Permission Boundary

Answer 4

A permissions boundary sets the maximum permissions that an identity-based policy can grant to an IAM entity.

Question 5

ACL

Answer 5

Use ACLs to control which principals in other accounts can access the resource to which the ACL is attached

Question 6

Service Roles

Answer 6

IAM roles that can be assumed by an AWS service

Question 7

ABAC

Answer 7

defines permissions based on attributes

Question 8

iam:AWSService

Answer 8

control access for a specific service role.

Question 9

iam:OrganizationsPolicyId

Answer 9

key provides the IAM entity access to specific SCPs.

Question 10

iam:PermissionsBoundary

Answer 10

checks that the specified policy is attached as a permissions boundary on the IAM principal resource.

Question 11

iam:PolicyARN

Answer 11

checks the Amazon Resource Name (ARN) of a managed policy in requests that involve that same managed policy

Question 12

iam:ResourceTag

Answer 12

checks that the tag attached to the identity resource, either a user or role, matches the specified key name and value provided.

Question 13

iam:PassedToService

Answer 13

specifies the service principal of the service to which a role can be passed.

Question 14

iam:associatedarn

Answer 14

specifies the ARN of the resource to which this role will be associated at the destination service.

Question 15

NotPrincipal

Answer 15

specify an exception to a list of principals.

You cannot use the NotPrincipal element in an IAM identity-based policy. You can use it in the trust policies for IAM roles and in resource-based policies.

Question 16

AWS Security Token Service (AWS STS)

Answer 16

create and provide trusted IAM users or users that you authenticate (federated users) with temporary security credentials that can control access to your AWS resources.

Question 17

IAM roles for Amazon ECS tasks

Answer 17

you can specify an IAM role to be used by the containers in a task. Applications are required to sign their AWS API requests with AWS credentials, and this feature provides a strategy to manage credentials for your application’s use. This is similar to how Amazon EC2 instance profiles provide credentials to EC2 instances.