IAM 2 Flashcards
Roles
When you assume a role, what happens to abilities of the account you assumed from?
Still there and active, but have to use the other creds
Roles
What abilities do you inherit from your old creds when you assume a role?
None: your new creds from sts:AssumeRole get nothing from creds used to assume.
Roles
User john wants to assume role DbAdmin, what has to be in place?
John needs sts:AssumeRole, DbAdmin needs John in its Trust Policy.
Roles
Assume role, then permissions on the role change. What happens?
Previously-generated temp creds from STS carry the just-made Role permission changes!
Confused Deputy
Simple description of Confused Deputy?
I call DevOps Inc. Catagram and Doggogram both trust DevOps to assume role. Trick DevOps to assume wrong role!
Confused Deputy
Why is this a problem? Role ARNs are secrets not known anywhere?
Role ARNs are not considered sensitive, OK to have them available.
Confused Deputy
What’s the fix for Confused Deputy?
External ID in Policy – the External ID is secret, Role ARNs aren’t.
Confused Deputy
Why is aws:SourceArn so important to security?
Helps prevent Confused Deputy
Confused Deputy
How do you spot places of potential Confused Deputy?
Cross-account Roles that trust other accounts to modify things in my account.
Switchrole
What is “Switch role”?
Menu option on the AWS console
Switchrole
Why don’t I see a list of roles I can switch to on the AWS Console?
You have to manually add them (account + role, give it a display name)
Switchrole
How do you Switchrole to a role in another AWS account (on the console)?
Same as your own account, just enter AWS account number and role on console
PassRole
What’s “PassRole”?
A Role you can give to other services to assume, but you can’t assume it.
PassRole
Why is PassRole good?
CloudFormation: you don’t have permission to create things, but can give the Role to CFN to do it.
PassRole
How do you see which IAM users have MFA enabled and when they used access keys?
Credential Report from the IAM Console
PassRole
Change permissions on a Role. What happens to already-assumed creds?
They immediately are affected.
Revoke Temp Creds
How do you revoke temporary credentials?
Can’t! Once created, you can cancel them.
Revoke Temp Creds
So what do you (human) do the second temp creds get out into the wild?
AWS console, Role, click “Revoke Sessions”
Revoke Temp Creds
What does revoking sessions do?
Adds policy AWSRevokeOlderSessions to the Role with “now” as the conditional date
Revoke Temp Creds
How does revoking one session impact other sessions?
Also immediately invalidates them! The change was on the ROLE. They need to get new creds.
Revoke Temp Creds
What’s the key thing to remember for the exam about revoking creds?
You can’t. You can add a conditional deny-all on the assumption date.
Revoke Temp Creds
Why can’t you just change the trust policy on a Role to lock out someone with creds?
Trust policy only used when assuming the role. Once you have temp creds, you’re good.
Service Roles and Service-Linked Roles
What is a Service Role?
Role you create that you assign to EC2, S3, SQS, Lamba for those services to act.
Service Roles and Service-Linked Roles
How can you tell if a Role is a Service Role?
Check trust policy for Service Principals
Service Roles and Service-Linked Roles
What is a Service-Linked Role?
Created by AWS, ro, used by service in the background to work with your other resources.
Service Roles and Service-Linked Roles
Service-linked Role name pattern?
“AWSServiceRoleFor______” <– service it applies to
Service Roles and Service-Linked Roles
Example of a Service-Linked Role for EC2 alarms?
AWSServiceRoleForCloudWatchEvents: so CWE can mess with your EC2 instances when alarming
Service Roles and Service-Linked Roles
Example of a Service-Linked Role for managing EC2 instances?
AWSServiceRoleForAmazonSSM: can mess with EC2, run its own Lambda functions
Service Roles and Service-Linked Roles
Help! The SSM Service-Linked Role isn’t listed on my account!
It (and many other SLRs) are created when you configure SSM.
Service Roles and Service-Linked Roles
Can you edit a Managed Policy?
Yes if you created it, no if it’s AWS-provided.
