IAM 3 Flashcards
ABAC
What is ABAC?
Access-based access control: make AuthZ decisions based on Tags
ABAC
Why does ABAC scale so well?
Don’t modify tons of Role Policies when you add new things, just tag each resource.
ABAC
Why is ABAC more flexible than RBAC?
A human with 5 roles just has 5 Tags on their IAM User – Policies grant from Tags.
ABAC
How do I do ABAC when I federate from SAML, etc.?
Have the provider pass session tags with the identity – they are Tags in AWS.
ABAC
How do you restrict what an IAM User can do if I tag the IAM User?
Use ${PrincipalTag/department} in Resources or Conditions
AAA
What is “AAA” for security?
Authentication, Authorization, and Access control
AAA
What is an example of Authentication?
Username + password, token from web federated login
AAA
What is an example of Authorization?
IAM Policy
AAA
What is Access control?
Higher-level concept including the other two parts of AAA
AAA
Example of simplest Access Control?
Username, password, IAM Role
AAA
Example of network Access Control?
NACLs in a VPC: no username, humans, or logins at all
MFA
What are 4 types of MFA Factors?
Knowledge, posession, inherent, location
MFA
Examples of MFA factor knowledge?
username, password, combination
MFA
Examples of MFA factor posession?
Bank card, dongle, MFA phone app, yubikey
MFA
Examples of MFA factor inherent?
Fingerprint, face, voice, iris
MFA
Examples of MFA factor location?
physical GPS location, bluetooth pair, network (corp or wifi)
MFA
Three types of MFA devices?
Physical, U2F key, virtual
MFA
Example of a physical MFA device?
Gemalto token that generates numbers
MFA
Example of a U2F key?
Yubikey that generates long string of alphanum
MFA
Examples of virtual MFA device?
Google authenticator and Duo Mobile
MFA
How does physical MFA tech work?
Key written on physical device, enter it on AWS conosle
MFA
How does virtual MFA device work?
Scan QR code or enter Secret Key created by AWS on AWS Console
MFA
MFA lost/stolen?
“Sign in using alternative factors”: verification email, AWS calls your registered phone number
MFA
You login with a username and a password: 1fa/2fa/3fa?
1-factor: both user and pass are things you KNOW
Permission Boundaries
What do Permission Boundaries apply to?
Only to Principals (Users or Roles), not Groups or Resource Policies.
Permission Boundaries
Where do you create Boundry Policies?
Policies. Boundary Policies are just Policies.
Permission Boundaries
What’s the use case for Permission Boundaries?
Delegating admin permissions: can alter other accts, can’t elevate yourself.
Permission Boundaries
Permission Boundary grants you s3:GetObject, your User policies don’t deny it. Have it?
No: Permission Boundaries don’t grant anything, they define the edges of what you can have.
