IAM

Question 1

What does IAM stand for?

Answer 1

Identity and Access Management

Question 2

True or false, IAM is a global service?

Answer 2

True

Question 3

What should a root account be used for?

Answer 3

For AWS account setup only

Question 4

Define User

Answer 4

People within your organisation that can be assigned to groups

Question 5

True or false, a group can contain other groups?

Answer 5

False

Question 6

True or false, users need to be assigned to groups?

Answer 6

False - however, it is bad practice to not assign user’s to groups

Question 7

True or false, a user can belong to many groups?

Answer 7

True

Question 8

What is an IAM policy?

Answer 8

JSON documents that define a set of permissions for making requests to AWS services, and can be used by IAM Users, User Groups, and IAM Roles.

Question 9

What principle should you apply when assigning privileges?

Answer 9

Do not give more permissions then what the user needs.
(Grant least privilege)

Question 10

Define Group Policies

Answer 10

Policies applied to everyone in a group

Question 11

Define Inline Policies

Answer 11

Policies applied to a specific user

Question 12

What does a IAM Policy structure consist of? (x3)

Answer 12

• Version: policy language version
• ID: (Optional) Identifier for the policy
• Statement: One or more statements

Question 13

What does a IAM policy statement consist of? (x6)

Answer 13

• SID: (Optional) Identifier for the statement
• Effect: Indicates whether the statement allows or denies access, value can be either “Allow” or “Deny”
• Principle: Account / user / role the policy is applied to
• Action: List of actions this policy allows or denies
• Resources: List of Resources to which the action is applied to
• Conditions: (Optional) Conditions for which this policy is in effect

Question 14

What can you do with IAM Password Policy (x5)

Answer 14

• Specify minimum password length
• Require Specific Character types
• Allow all IAM users to change their passwords
• Require users to change their passwords (make passwords expire)
• Prevent password reuse

Question 15

List Multi Factor Authentication Options (x4)

Answer 15

• Virtual MFA Devices
  – Google Authenticator
  – Authy
• Universal 2nd Factor (UTF) Security Key
  – YubiKey
• Hardware Key Fob MFA Device
  – Gemalto
• Hardware Key Fob MEA Device + AWS GovCloud (US)
  – SurePassID

Question 16

What is an IAM role?

Answer 16

An IAM entity that defines a set of permissions for making requests to AWS services, and will be used by an AWS service

Question 17

List Common IAM Roles (x3)

Answer 17

• EC2 Instance Roles
• Lambda Function Roles
• Roles for CloudFormation

Question 18

List IAM Security Tools (x2)

Answer 18

• IAM Credentials Report
• IAM Access Advisor

Question 19

What is the IAM Credential Report?

Answer 19

An account-level report that lists your account’s users and the status of their various credentials

Question 20

What is IAM Access Advisor?

Answer 20

(user-level)
Access Advisor shows the service permissions granted to a user and when these services were last accessed.

You can use this information to revise your policies.

Question 21

List IAM Best Practices (x9)

Answer 21

• Don’t use root account except for AWS account setup
• 1 physical user for 1 AWS user
• Assign users to groups and assign permissions to groups
• Create a strong password policy
• Use and enforce MFA
• Create and use roles for giving permission to AWS services
• Use Access Keys for Programmatic Access (CLI / SDK)
• Audit permissions of your account using IAM Credentials Report and IAM Access Advisor
• Never share IAM users and Access Keys

Question 22

What is AWS’s responsibility for IAM (x3)

Answer 22

• Infrastructure (global network security)
• Configuration and vulnerability analysis
• Compliance validation

Question 23

What is Your responsibility for IAM (x5)

Answer 23

• Users, Groups, Roles and Policies management and monitoring
• Enabling MFA on all accounts
• Rotating all your keys often
• Using IAM tools to apply appropriate permissions
• Analysing access patterns and reviewing permissions