IAM, ACCOUNTS AND AWS ORGANISATIONS Flashcards
IAM Policies Priority? (The first is the higher)
- Explicit DENY
- Explicit ALLOW
- Default DENY (Implicit)
What are the types of IAM Policies?
- Inline Policy
- Managed Policy
Does these 2 ARN overlap?
- arn:aws:s3:::catgifs
- arn:aws:s3:::catgifs/*
No. The first references a Bucket and the second the Objects in the bucket
What are IAM users limits?
- only 5000 IAM users/account
- user can be a member of maximum 10 groups
What are IAM Groups?
Are containers for Users. I cannot login into an IAM Group and they do not have credentials of their own.
Is there a default all users IAM Group in AWS?
No
Can you nest IAM Groups?
No
Are there any IAM Group limits?
300 Groups/account (but can be increased w/ support ticket)
Can IAM Groups be referenced as a principal in a policy? For example when applying a resource policy?
No. Groups are not a true identity.
What are the IAM Roles Policies?
- Trust Policy
- Permissions Policy
What is STS?
Secure Token Service
What is a service-linked role?
- IAM Role linked to an AWS service
- You cannot delete the role until it’s no longer required
What is AWS Organizations?
It helps managing larger numbers of AWS Accounts
What is SCP?
Service Control Policies - that is a account permission boundary
Can I attach a SCP to a Root Container of the Organization?
No. The SCP will never affect the Management account
Can you apply a SCP to the account root user of the Root Container of the Organizations?
Yes. And it will also indirectly restrict the Root Container of the Organization
Do SCP grant permissions?
No
What is the default for SCP: Allow list or Deny list?
Deny list - which means that it will allow everything except what is defined in the Deny list
What is CloudWatch Logs?
A Public Service. It allows to store, monitor and access logging data
What is CloudTrail?
It is a product which logs API calls and account events
For how long are CloudTrail Events stored by default in Event History?
90 days (no cost for 90 days of history) and no S3
Is CloudTrail by default storing Management and Data events?
No. Only Management events.
Is CloudTrail regional or global service?
Regional
Where does CloudTrail logs data?
In the same region of the service or in us-east-1 if they are global services (IAM, STS, CloudFront)
