IAM Flashcards
IAM
Identity Access Management - Where you manage your AWS users and their access to AWS Accounts and Services.
What are the common uses for IAM
To Manage
- Users
- Groups
- IAM Access Policies
- Roles
What is the name of the default user when you create an AWS account?
“root” user
What permissions does the “root” user have by default?
The root user has FULL administrative rights and access to every part of the account.
What access do new users have upon creation?
By default, new users are created with No access to any AWS services (except the ability to login).
IAM Setup (Best Practices)
Delete root access keys Activate MFA Create individual IAM users Use groups to assign permissions. Apply IAM Password Policy
IAM Daily Best Practice
Login and Perform work as an IAM User
Which policy overrules all other policies?
Deny All overrules any allow rules.
Define - Admin, Power User, and Read Only Access
- Full Access to All AWS Resources.
- Admin without user/group management permissions.
- Only view AWS resources.
What is the Policy simulator?
Allows you to test policies to see if they provide expected behavior before applying to groups/users.
How many policies can be attached to a user?
Unlimited.
Can policies be attached to AWS resources / services?
No (roles).
Best Practice - Should user credentials be stored or passed to an EC2 Instance?
No.
Does an explicit deny overrule an explicit allow?
Yes.
Benefits of Groups
- Allow you to assign IAM permission policies to more than one user at a time. This allows for easier access management to AWS resources.
Roles are applied to…
AWS resources / Services.
How many roles can be assigned to an EC2 instance?
One at a time.
Policies are attached to a role and the EC2 instance can assume that role. T/F
True
STS
Security Token Service.
Temporary access to AWS resources.
Once expired they can no longer be utilized.
What components are returned when utilizing a STS.
Security Token
An Access Key ID
A Secret Access Key
What are the benefits of STS?
Temporary Access
Do not have to embed credentials in Resources / Application.
Can Grant access without an IAM account.
Do not have to manage, rotate or revoke.
When should you use STS?
Identity Federation (AD)
Web Federation (Facebook, Google, etc.)
Roles for cross account access (prod/dev).
Roles for Amazon
STS API Calls
AssumeRole
AssumeRoleWithWebIdentity
GetFederationToke
GetSessionToken
What are API Access Keys
Are required to make programattic calls to AWS from CLI, Powershell, SDKs, Direct HTTP calls.
What access method requires API Access Keys
CLI
API Facts
Keys are available one time.
AWS will not regenerate the same set of keys.
API credentials have to associated with a USER.
Roles do not have API credentials.
In Console you can only see the Access Key ID
Must deactivate current API credentials before generating new ones.
NEVER store API keys on an EC2 instance.
What default permissions does an IAM user have upon creation?
non-explicit “deny” for all AWS services.
Attributes of IAM access credentials.
- User received unique access credentials
- Credentials should never be stored or passed to an EC2 instance.
- Credentials should never be shared with others.
Can an IAM user have multiple policies applied to their account?
Yes - users can have multiple policies applied to them directly or via a group.
T/F - Explicit allow always override explicit deny IAM policies.
False - explicit deny always overrides an allow.
T/F - MFA can be configured on a per user basis for login and resource access / actions.
True.
What is the first user account created in an AWS environment?
- Root user.
What permissions does the root user have upon creation?
FULL Administrative rights.
Root user best practices.
- Do not use root access for daily work / administration.
2. Protect root account with MFA.
IAM Groups
- A Collection of users.
- Easier management to AWS resources.
- Allow permissions/policies to more than one user at a time.
Account connection tools.
AWS Management Console AWS CLI (Command Line Interface).
IAM Policy
Permissions that can be assigned to users or groups that allow access to AWS resources.
IAM Policy pre-built templates
- Administrator Access - Full access to all AWS resources.
- Power User Access - Admin access except cannot manage users/groups.
- Read only Access - Only view AWS resources.
T/F You cannot create custom policies.
False - policy generator or written from scratch (JSON).
IAM Role
A role is something that another entity can “assume” and in doing so acquires the specific permissions defined by that role.
