IAM

Question 1

Was ist IAM, root-user, users und groups?

Answer 1

• IAM = Identity and Access Management
• Root account = created by default, shouldn’t be used or shared
• Users = people within an organization, user 0 bis * groups
• Groups = only contain users

Question 2

IAM: Permissions

Answer 2

• Users or Groups can be assigned policies
• policy = permissions of the users
• least privilege principle
• policy direkt auf user (nicht group level) = inline policy

Question 3

How to protect Root Accounts and IAM users?

Answer 3

• strong password and Multi Factor Authentication (MFA)

Question 4

How can users access AWS?

Answer 4

• AWS Management Console
• AWS Command Line Interface (CLI)
• AWS Software Developer Kit (SDK)
• CLI and SDK protected by access keys

Question 5

IAM Roles for Services

Answer 5

• for actions on your behalf –> permissions to AWS services with IAM Roles (z.B. EC2, Lambda, CloudFormation)

Question 6

IAM Security Tools (Audit)

Answer 6

• IAM Credentials Report (account-level)
• IAM Access Advisor (user-level)

Question 7

IAM Guidelines & Best Practices

Answer 7

• One physical user = One AWS user
• Assign users to groups and assign permissions to groups
• strong password policy
• MFA
• Roles for giving permissions to services
• Never share IAM users & Access Keys

Question 8

Shared Responsibility Model for IAM

Answer 8

• AWS = Infrastructure, Configuration, vulnerability analysis, Compliance
• Customer = IAM, MFA and Permissions