IAM, ACCOUNTS AND AWS ORGANISATIONS Flashcards
Specifiy a list of resources to which the api actions apply
Resource
Optional – specifies the preliminary rules under which the policy grants permissions
Condition
List of actions or api that the policy allows or denies
Action
Refers to an IAM Identity you define
Principle
Only 2 possible values – allow, deny
Effect
First priority when evaluating policy logic
Explicit Denies
Second priority when evaluating policy logic
Explicit Allow
Third priority when evaluating policy logic
Default Deny
Remains unchanged even if you delete its associated IAM identity, It doesn’t have a strict one-to-one relationship to its associated IAM identity
Standalone Policy
Will be automatically be deleted if you delete its associated identity, Has a strict one-to-one relationship to its associated IAM identity
Inline Policy
Used for special or exceptional allows or denies
Inline Policies
The identity used for anything requiring long-term AWS access usually only a single principal
IAM User
Person or application that makes requests to IAM to interact with resources
Principal
Process where principal proves their identity
Authenticate
Uniquely identify resources within any AWS accounts
Amazon Resource Name (ARN)
max iam users per account
5000
max number of group iam users can be apart of
10
containers used to make management of IAM users easier
Groups
Limited to 300 per account but can be increased
IAM Groups
Can groups be referenced as a principal in a policy?
No
Used by an unknown number of principals on a temporary basis that represents the level of access in an AWS Account
IAM Role
Generated by STS and given to identites that assume roles that act as access keys
Temporary Security Credentials
Anything that is not an AWS Identity needs permissions should be given?
IAM Role
Can external account be used in AWS directly?
No
Using an external identity provider and giving the external identities roles to perform actions
ID Federation
Predefined IAM Role that is linked to a specific AWS Service
Service-linked roles
Product that allows large business to manage multiple accounts
AWS Organizations
Account used to create an organization and receives the bill for all members apart of that organzation
Management Account
Can the management account be restricted using SCP?
No
Account permission boundaries that limit what the account (including root user) can do.
Service Control Policies
Do service control policies grant permissions?
No just define what is and isnt allowed
Solution If your identity store is not compatible with SAML 2.0
build a custom identity broker application
