IAM

Question 1

What does IAM stand for?

Answer 1

Identity Access Management

Question 2

What is IAM?

Answer 2

It is a AWS Service used to manage users and their level of access to the AWS console.

Question 3

What are IAM Users?

Answer 3

People using the AWS console.

Question 4

What are IAM Groups?

Answer 4

A Collection of users under 1 set of permissions

Question 5

What are IAM Roles?

Answer 5

Permissions that are created and assigned to:

• AWS Resources
• another AWS account
• Web identity
• or SAML

Question 6

What are IAM Policies?

Answer 6

Documents that define one or more permissions. They can be attached to a:

• User
• Group
• or Role

Question 7

What happens if you loose your Secret Access Key in IAM?

Answer 7

You have to generate a new Access Key and Secret Access Key.

Question 8

What are the 3 IAM Policy Types?

Answer 8

1) Managed
2) Customer Managed
3) Inline

Question 9

Describe a Managed IAM Policy

Answer 9

• Created and administered by AWS

- CANNOT be changed by the customer

Question 10

Describe a Customer Managed IAM Policy

Answer 10

• Customer Created

- Used when managed policies don’t meet needs of your environment

Question 11

Describe an Inline IAM Policy

Answer 11

• Embedded w/ in user group to which it applies
• 1:1 relationship
• Most cases AWS recommends managed over inlined policy

Question 12

What does AWS recommend for security (IAM)?

Answer 12

To use roles because it allows you not to use access key ids and secret access keys.

Roles are also controlled by policies which will take immediate affect if changed.

Question 13

What is identity federation?

Answer 13

It is an IAM feature that allows users to get temp access to your AWS account.

Question 14

What is STS?

Answer 14

AWS Security Token Service

• It creates and gives users temp security credentials to get access to AWS resources
• Global Service with a single endpoint (https://sts.amazonaws.com)

Question 15

What are the Assume Role Options?

Answer 15

• AssumeRole
• AssumeRoleWithSAML
• AssumeRoleWithWebIdentity

Question 16

When to use AssumeRole

Answer 16

Used for cross-account access.

Need temp credentials that include an access key ID, secret access key, and security token.

You can also include AWS MFA.

Question 17

When to use AssumeRoleWithSAML

Answer 17

Want users to have temp credentials who have been authenticated with a SAML authentication response.

Want to link enterprise identify store/directory to role-based AWS access without having to configure users.

Does not support MFA.

Question 18

When to use AssumeRoleWithWebIdentity

Answer 18

Want to get temp security credentials after a user has verified with :

• Cognito
• Amazon
• Facebook
• Google
• OpenID Connect-compatible identity provider

Question 19

What is a GetFederationToken?

Answer 19

It is an STS Get Token that returns temp credentials for a federated user which include:

• access key ID
• secret access key
• security token

Used typically for a proxy app that gets temp credentials for distributed app inside a corporate network.

Does NOT support MFA

Question 20

What is a GetSessionToken?

Answer 20

It is a STS Get Token that returns temp credentials for AWS account or IAM User.

• access key ID
• secret access key
• security token

Used if want MFA to protect certain AWS API calls.

Question 21

When using the AWS CLI how can you make AWS API calls?

Answer 21

Use your Access Keys (must have necessary permissions attached to them)

Think EC2 login from console.

Question 22

What is AWS SSO?

Answer 22

It is a service that allows you to define federated access permissions for users or groups in a single centralized directory and allow them to access multiple AWS accounts. Works with IdP. As well as SAML-enabled cloud applications (Salesforce, Office365 ect).

Can also audit user’s access to cloud services using CloudTrail.

Question 23

Are IAM role secure to make API requests from instances?

Answer 23

Yes they are encrypted and rotated automatically.

Question 24

How to allow an on-premise data center to have access to various AWS services?

Answer 24

create a new IAM user with programatic access. Create crediential file on app server (~/.aws/credentials) with access keys.

For apps running outside of AWS env you must use an IAM user (even though best practice is role)