IAM Flashcards
What does IAM stand for?
Identity and Access Management
Can Groups in IAM overlap on users
Yes
IAM Policy
is a json file that state what a group or user is allowed to do
Is User Console Region specific?
no, user is allowed in all regions
What is a User Group
It is
Will attaching IAM Policy at a group level add the permissions to all users?
YES
What is an inline Policy?
A policy for a single users
What does a policy JSON consists of?
At least Version, and Statement,
What does a Statement of policy JSON consists of?
Sid - statement id some string
Effect: Allow / Deny
Action: “” - list of action that should be allowed.
e.g iam:Get*
Resource: the resource that the permision is refering to
IAM Password policy
minimum length
special characters
changing IAM Users password
password expiration
prevent re-use
Hardware OTP tokens
TOTP - time based
HOTP - counter based
What are 3 ways to access AWS?
Management Console
CLI
SDK
What is an IAM Role
Permissions for a AWS Service that needs to access some our resources. e.g. a EC2 Instance trying to access S3 Bucket
What is IAM Last Acessed
list of all users and their credentials
What does IAM Access Advisor?
Shows what permissions are used by user and allow to revoke the unused ones (least priviledge principle)
What is shared responsibility model?
There are some elements that AWS is responsible for and some that us as a user are.
What is a AWS Budget?
It is a threshold that will alarm us when we reach a particular spending goal. Even multiple times. (at. 85%, 100% or forecasted spent is 100%)
What is AWS EC2?
Elastic Compute Cloud (IaaS)
What does AWS EC2 consists of?
Renting virtual machines (EC2)
Storing data on virtual drives (EBS)
Distributing load across machines (ELB)
Scaling the services using an auto scaling group (ASG)
What OS can be put on EC2?
Linux, Windows or Mac OS
How to bootstrap EC2?
Using EC2 User data script.
What does bootstraping mean?
Installing updates, software
What are the EC2 Types?
e.g m5.2xlarge
m - class
5 - generation
2xlarge - size
-> compute optimized (start with C)
-> Memory optimized (R - RAM, X and Z)
-> Storage Optimized - for Databases (
What are Security Groups?
Define what’s allowed in and out and where.
Can reference IP or other Security Group
a.k.a Firewall
divided into inbound and outbound
What allows referencing security groups to other ones?
Allowing for a direct connection between EC2 instances that reference each others security groups
What is a port for Remote Desktop Protocol a.k.a logging into windows instance
3389
When we encouter a timeout while connecting to the instance what can be causing it?
missing security group config
Is there a limit how many security groups can be attached to a EC2?
no
How to add permissions to our EC2 Instance within the AWS World
A EC2 can be attached an IAM Role
What are EC2 Purchasing Options
- On-Demand - short term uninterrupted workloads
- Reserved (1 & 3 Years) -
- Savings Plans (1 & 3 Years) - commitment to a x $ of usage
- Spot Instances - very short workload, cheap, can be stoped
- Dedicated Hosts - entire physical server
- Dedicated Instances - no one will share hardware with us
- Capacity Reservations - reserve capacity in a specific AZ for any duration
What is Reserved EC2 Purchasing option?
specific type, region, tenancy and OS (up to 72% discount compared to On-Demand)
Payment (upfront +++, partially upfront ++, no upfront +)
Period(1 year +, 3 years +++)
+ - discounts
What is EC2 Savings Plans?
discount of up to 72% compared to On-demend
commit to certain level of usage (e.g 10$ an hour for 1 or 3 years)
everything beyound that will be billed at on-demand rate
locked to instance type and region but not size e.g (m5.xlarge, m5 2xlarge)
What are EC2 Spot Instances?
discount of up to 90% (we set what is the max we want to pay)
but can be interrupted if the price goes up
EC2 dedicated hosts
EC2 Instance fully dedicated to our use. Allows for compliance. Most expensive option.
2 Options:
on-demand pay per sec
reserved (1 / 3 years)
allows access to dedicated hardware
EC2 Dedicated Instances
We may share hardware with other instances in the same account
EC2 Capacity Reservations
You pay no matter if you use them or not. (on demand rate)
- no time commitment but also no billing discounts
- combine with regional reserved instances and savings plans to benefit from discounts
Short term uninterrupted workloads in a specific az
What is AWS responsible for on EC2?
Global network security
Isolation of physical hosts
Replacing faulty hardware
compliance validation
What is User responsible for on EC2?
Security Groups rules
system pathes and updates
Software installed
IAM Roles and user management
Data Security on the instance
