Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS SysOps > IAM, Accounts, and AWS Organizations > Flashcards

IAM, Accounts, and AWS Organizations Flashcards

1
Q

IAM Policies

A

Grants or denies access to identities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Policy Document

A

Written in JSON to tell what is allowed or denied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

(T/F) An individual can have multiple IAM Policies

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SEAR

A

Statement ID, Effect, Action, Resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IAM Policy Document Statements

A

SEAR or SARE - Statement ID or SID (optional), ex. Full Access; Action can be very specific and then the service : and can be specific or * ex. Action: [“s3:&”]; Resource specifies the resources, can be specific or wildcard ex Resource: [“*”]; Effect is to either allow or deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

DAD

A

Priority of IAM Policy Statements - Deny, Allow, Deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Priority of IAM Policy Statements

A

First is explicit deny. If a resource is denied, it cannot be accessed.
Second is explicit allow. If a resource is allowed and there is no explicit deny, it is allowed.
Third is implicit deny. If there is not statement allowing a service, it is denied implicitly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Two types of IAM Policies

A

Inline and Managed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Inline Policy

A

applying JSON to each account individually. Not best practice. Got to make changes to each individual JSON policy. Usually used for special or exceptional allow or deny.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Managed Policy

A

created as its own object and attach it to any policy that wants to gain those access rights. They are RESUABLE and LOW MANAGEMENT OVERHEAD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Two types of Managed Policies

A

AWS Managed Policies and Custom Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IAM Users

A

an identity used for anything requiring LONG-TERM AWS access e.g. HUMANS, APPLICATIONS or SERVICE ACCOUNTS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Authenticated Identity

A

U&P and Access Keys (services); proves identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authorization

A

IAM checking the authentication and allowing or denying access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Exam Alert: (T/F) Internet scale apps and large organizations with more than 5,000 users should use IAM Users.

A

False. 5,000 IAM users PER ACCOUNT; IAM User can be a member of 10 GROUPS; This has design impacts – remember the limits for the exam which may discuss large organizations or Internet scale apps that have more than 5,000 users then IAM will not be the right choice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

IAM Groups

A

containers for USERS; solely for organizing users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

(T/F) You can log into a group

A

False. You CANNOT log into a group – no credentials, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

(T/F) An IAM user can only be a member of one IAM Group.

A

False. An IAM user can be a member of multiple IAM Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IAM Group Policies

A

Two kinds of Group Policies both Inline or Managed and have permissions from each group plus whatever permissions for the user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

(T/F) There isn’t a built in all users group in IAM

A

True. There isn’t a built in all users group in IAM – you can create one but it isn’t native.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

(T/F) There is no nesting in groups

A

True. You can not nest one group inside another group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Total groups per account

A

300 Groups per accounts but can be increased with support tickets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Reference Policy

A

controls access to a specific resource and allows or denies identities to that resource; reference through ARN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

(T/’F) Groups are a true identity of a user

A

False. Groups are NOT a TRUE IDENTITY. They can’t be referenced as a PRINCIPAL in a resource policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

IAM Roles

A

exists in AWS account. Best suited for an unknown number or multiple principals. Can be internal or external.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

(T/F) IAM roles are ASSUMED. YOU BECOME that role.

A

IAM roles are ASSUMED. YOU BECOME that role. Generally short term. Think about a mobile app that gains access through a role and become an identity in an AWS account for a short period of time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Two types of policies attached to IAM Roles

A

Trust policy and permissions policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Trust Policies

A

says what identities can access that role – reference identities in the same account or services and can reference other identities in other AWS accounts, even anonymous, or SSO via Google, Facebook, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Permissions Policy

A

says what can be accessed.

30
Q

(T/F) Roles cannot be accessed with Resource Policies

A

False

31
Q

STS

A

Secure Toke Service – sts:AssumeRole – know that roles are involved. Works with Temporary Security Credentials

32
Q

When to use IAM Roles

A

All through Permissions Policy;
- AWS Lambda functions known as a Lambda Execution Role so you don’t need to hardcode permission (access keys);
- out of the usual situations (emergencies) think third-party help desk; adding AWS into an on-prem environment – EXISTING IDENTITIES through SSO or go above the 5000 user limit;
- application with 1,000,000 of users that may need to access DynamoDB (ride sharing app) – Web identity Federation; cross AWS account

33
Q

Web identity Federation

A

uses IAM roles to access certain services and allows for SSO through Google, Facebook, etc. – NO AWS CREDENTIALS on the APP, uses EXISTING customer LOGINS, scales to 1,000,000,000’s of accounts and beyond

34
Q

ID Federation

A

small number of roles to manage and/or external

35
Q

(T/F) External accounts can be used in AWS directly

A

False

36
Q

Break Glass Situations

A

emergency situations

37
Q

Function Invocation or Execution

A

running a Lambda function

38
Q

Service Linked role

A

IAM role linked to a SPECIFIC AWS SERVICE; PREDEFINED by a SERVICE; providing permissions that a SERVICE needs to interact with OTHER AWS SERVICES on your behalf; SERVICE might create/delete the role or allow YOU to during the SETUP or within IAM

39
Q

(T/F) You can’t delete the service linked role until it’s no longer required

A

True

40
Q

Under Resource in the JSON

A

don’t try and guess the service-name of the resource, the FORMAT can differ and is CASE sensitive

41
Q

PassRole

A

gives the ability to implement role separation.

42
Q

AWS Organizations

A

Consolidated billing and identities of all accounts.

43
Q

Hierarchy Structure of AWS Accounts

A

take a standard AWS account and create an organization – this is MANAGEMENT (master) account – and invite other accounts into the organization and then those invited accounts are member accounts of the organization. Hierarchical. Consolidated Billing (single bill) to the payment account aka Management account. Consolidation of RESERVATIONS and VOLUME DISCOUNTS.

44
Q

Organization Root

A

Top of the Organization hierarchy. Container within an AWS organization that contain AWS accounts. Also contain other containers aka organization units or OUs. Organization root at the top and OUs underneath hierarchically.

45
Q

Standard AWS Account

A

An account not within an organization

46
Q

Service Control Policy (SCP)

A

restrict what AWS accounts can do in the AWS organization.

47
Q

(T/F) Creating a new account within AWS organizations requires no invite process.

A

True

48
Q

(T/F) Organizations need IAM users in each account

A

False. Organizations don’t need IAM users in each account as IAM roles can be used to access other AWS accounts.

49
Q

Role Switch

A

federation on-prem identities switch into other accounts in the organization and assuming the role.

50
Q

Exam question, the overlap between identity policies and SCP

A

If not allowed in IAM but allowed in SCP then won’t be allowed. If allowed in IAM but denied in SCP then not allowed. If allowed in IAM and allowed in SCP then allowed.

51
Q

Service Control Policy (SCP)

A

ACCOUNT PERMISSIONS BOUNDARIES AND LIMIT WHAT ACCOUNT CAN DO including ROOT USER in ORGANIZATIONS. DON’T GRANT PERMISSIONS – THEY LIMIT PERMISSIONS. ALLOW or DENY list. Follows DAD. You can’t restrict the root user, it will allows have full control of the account but SCP can restrict the account thereby restricting the root user.

52
Q

CloudWatch Logs

A

PUBLIC SERVICE; STORE, MONITOR, and ACCESS logging data; AWS INTEGRATIONS – EC2, Lambda, CloudTrail, and more; if no integration, need CLOUDWATCH AGENT; METRIC FILTER (create metrics from the logs)

53
Q

Log Stream

A

sequence of log events from the same source

54
Q

Log Group

A

container for log streams; define retention and permissions and applies to all streams in the container; metric filters resides here as well

55
Q

CloudTrail

A

REGIONAL service. Logs API calls/activities as a CLOUDTRAIL EVENT. Stores 90 days by default in EVENT HISTORY; enabled BY DEFAULT at no cost.

56
Q

Trail (CloudTrail)

A

To customize you need to create a TRAIIL. A trail can be configured for one region or all regions and can be stored in an S3 bucket indefinitely, you only pay for the space in the S3 bucket. CloudTrail can be integrated into CloudWatch logs with trails.

57
Q

(T/F) Logs in the region that they occurred in or log to US East 1 for global such as IAM STS CloudFront.

A

True

58
Q

Two types CloudTrail Events

A

MANAGEMENT (default) events and DATA (configured and $$) events.

59
Q

Exam alert, is CloudTrail in real time?

A

CloudTrail is NOT REAL-TIME, there is a delay (within 15 minutes generally).

60
Q

Service Catalog

A

DOCUMENT or DATABASE created by an IT team (service documentation); organized COLLECTION of PRODUCTS; KEY PRODUCT INFORMAIONT: owner, cost, requirements, support info, dependencies; defines approval of provisioning from IT and customer.

61
Q

AWS Service Catalog

A

SELF-SERVICE portal for end users; launch PREDEFINED PRODUCTS (ADMINS SET UP). Think of it like this, sales team needs to launch an EC2 instance but IT doesn’t want to give them the infrastructure capabilities with an AWS account so they set up AWS Service Catalog with CloudFormation and they can launch the instance that way. Build PRODUCTS into PORTFOLIOS.

62
Q

Admin role in Service Catalog

A

DEFINED PRODUCTS and PORTFOLIOS using CLOUDFORMATION TEMPLATES and SERVICE CATALOG CONFIGURATION then deploy PORTFOLIO to any service enabled regions. Service catalog users review PORTFOLIOS they have permissions on and LAUNCH PRODUCTS into service enabled regions. Service catalog, launches the infrastructure using DEFINED TEMPLATES. Service catalog users don’t need infrastructure permissions.

63
Q

Exam alert, see any question talk about a need for users or customers to release services with a tight infrastructure, think

A

Service Catalog

64
Q

Any exam questions about exploring cost or evaluate cost, also can give recommendations about reserved instance purchases

A

CostExplorer

65
Q

Cost anomaly shows in

A

CostExplorer

66
Q

SAML

A

Security Assertion Markup Language – Open Standard used by idP e.g. MS ADFS. INDIRECTLY use on premises ID w/ AWS. Used when using an ENTERPRISE identity provider (not Google SSO for example). EXISTING identity management team. SINGLE SOURCE OF TRUTH MORE THAN 5000 users. Uses IAM ROLES and TEMP CREDENTIALS (12 hour window).

67
Q

(T/F) SAML cannot use enterprise credentials directly, they have to be exchanged for AWS credentials.

A

True

68
Q

SSO

A

Manage SSO Access – AWS ACCOUNTS and EXTERNAL APPLICATIONS. Flexible IDENTITY SOURCE system. There is a built-in identity store, AWS Managed AD, On-premises AD by TWO WAY TRUST or AD CONNECTORS, or SAML 2.0.

69
Q

(T/F) SSO is not preferred by AWS vs traditional workforce identity federation.

A

False

70
Q

Two phases of SSO

A

1.) Single Sign on; 2.) Provides centralized permissions management across accounts.

71
Q

Exam Alert: If it is web identities such as Facebook, Twitter, Google, it won’t use SSO.

A

If it is enterprise identities, it will be SSO.

72
Q
A

AWS SysOps (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions