Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

___3 - AWS SAA-C03_2024-1204 > IAM, Accounts and AWS Organizations > Flashcards

IAM, Accounts and AWS Organizations Flashcards

1
Q

What is the maximum number of IAM users in an AWS account

A

5000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following are features of IAM groups
- Admin groupings of IAM Users
- Can hold Identity Permissions
- Can be used to login (Access Keys)
- Can be used to login (Username and password)
- Can be nested

A
  • Admin groupings of IAM Users
  • Can hold Identity Permissions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Within AWS policies, what is always a priority?

A

Explicit Deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What two policies are assigned to an IAM Role
- Permissions Policy
- Assumption Policy
- Resource Policy
- Trust Policy

A
  • Permissions Policy
  • Trust Policy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following are true for IAM Roles
- Roles have associated Long Term Credentials (Access Keys)
- Roles can be assumed
- When assumed - temporary credentials are generated
- Roles can be logged into
- When an identity logs into a role - temporary credentials are generated

A
  • Roles can be assumed
  • When assumed - temporary credentials are generated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What Three features are provided by AWS Organizations (pick all that apply)
- Consolidated billing
- Managed assistance for company and AWS account mergers
- AWS Account restrictions using SCP
- Account organisation via OU’s
- Protection against credential leaks
- Company ID reports

A
  • Consolidated billing
  • AWS Account restrictions using SCP
  • Account organisation via OU’s
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What functionality is provided by CloudTrail
- Log Ingestion
- Metrics management
- Account Restrictions
- Account wide Auditing and API Logging

A
  • Account wide Auditing and API Logging
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Is it possible to restrict what the Account Root User can do?
- Always
- Never
- If AWS Organisations are used
- If AWS Organizations are used .. but not the management account

A
  • If AWS Organizations are used .. but not the management account
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is Role Switching?
- Changing the permissions on an IAM Role
- Changing the TRUST on a Role
- Changing who can assume a Role
- Logging into a Role
- Assuming a role in another AWS account to access that account via the console UI

A
  • Assuming a role in another AWS account to access that account via the console UI
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are valid IAM Policy types (choose all that apply)
- AWS Managed Policy
- Customer Managed Policy
- Self-Managed Policy
- Inline Policies
- External Policies

A
  • AWS Managed Policy
  • Customer Managed Policy
  • Inline Policies
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are trust policies

A

The trust policy defines which principals can assume the role, and under which conditions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the 3 types of IAM identities

A

Users
Groups
Roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When is it usually a good idea to create IAM users

A

When you can picture one, named thing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are permissions policies

A

The permissions policy grants the user of the role the needed permissions to carry out the intended tasks on the resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the permissions policies priorities

A

First: Explicit deny
Second: Explicit allow
Third: Default deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When should you use inline policies

A

For exceptions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Can you log into IAM groups

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Do IAM groups have credentials

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Can groups be references as a principal in a policy

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Can groups be granted access by a resource policy

A

No

21
Q

Is there a builtin all-users group in IAM

A

No

22
Q

Can you do IAM group nesting

A

No

23
Q

Can you use external accounts/identities to access AWS resources?

A

No

24
Q

What kind of identity management should you use for a mobile app

A

Identity Federation

25
Q

Is a management account affected by SCPs

A

No

26
Q

What is a CloudTrail trail

A

A unit of config within the CloudTrail product

27
Q

Where does a CloudTrail trail log

A

It logs events for its region, or all regions if set (us-east-1)

28
Q

What is the default CloudTrail log price, and storage time?

A

Free, but only stores 90 days of data

29
Q

How can you use CloudWatch and S3 with Cloud Trails?

A

Using trails

30
Q

Is Cloud Trail logging real time?

A

No

31
Q

Can groups be applied group directly in a resource policy?

A

NO
* Groups can ONLY be used in IAM policies, not resource policies
* Use roles as a proxy when you need to grant group-based access in resource policies
* Remember the relationship: Groups → Roles → Resource Policies
* Bad eg. of group on a resource
```JSON{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Principal”: {
“AWS”: “arn:aws:iam::123456789012:group/Developers” // THIS WON’T WORK!
},
“Action”: [
“s3:GetObject”,
“s3:PutObject”
],
“Resource”: “arn:aws:s3:::example-bucket/”
}
]
}
~~~
* Good eg of group on a resource
~~~
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Principal”: {
“AWS”: “arn:aws:iam::123456789012:role/DevelopersRole” // CORRECT!
},
“Action”: [
“s3:GetObject”,
“s3:PutObject”
],
“Resource”: “arn:aws:s3:::example-bucket/”
}
]
}
~~~

32
Q

Permission boundaries set what?

A

Sets the maximum permissions an IAM entity (user or role) can have, regardless of the permissions granted by their standard policies.
Think of it like a container - no matter what permissions you grant inside the container, they cannot exceed its boundaries.
Key Concepts:
* Sets maximum allowed permissions (NOT granted permissions)
* Can be applied to IAM users and roles (not groups)
* Useful for delegation while maintaining control
* Evaluated alongside identity-based policies

Exam tips:
1. Boundaries don’t grant permissions by themselves
2. Both the permission policy AND boundary must allow an action
3. Can’t exceed boundaries even with resource-based policies
4. Useful for AWS Organizations to delegate admin tasks safely

```// Permission Boundary Policy
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: [
“s3:”,
“cloudwatch:”,
“ec2:Describe”
],
“Resource”: “”
}
]
}

// User’s Actual Permission Policy
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: [
“s3:”,
“rds:”, // This won’t work - outside boundary
“cloudwatch:”,
“ec2:Describe”,
“ec2:StartInstances” // This won’t work - outside boundary
],
“Resource”: “*”
}
]
}

33
Q

Can External accounts be used to access AWS resources directly? What do they use?

A
  • No
  • External accounts like AD, Google, Facebook, etc. must usea Identity Federation account, then must assume a role for access and use resources.
  • Remember any business with >5000 accounts must assume a role
34
Q

What are some examples of when to use a role?

A
  • Web ID Federation
  • Cross Account Access
  • Emergency Situations
  • Corporate mergers
  • Any thing needing more than 5000 accounts
  • AWS serives that need to perform a task on a belhalf
35
Q

Describe a Service Linked Role?

A
  • PassRole is NOT an API action - it’s a permission to pass a role to a service
  • PassRole is crucial for security (prevents privilege escalation)
  • Service-Linked Roles:
    1. * Are predefined by AWS
    2. Can only be assumed by the specified service
    3. Have permissions defined by AWS (you can’t modify them)
    4. Are automatically deleted when the service no longer needs them

Common example with Auto Scaling:
Auto Scaling needs to create/terminate EC2 instances
It uses a Service-Linked Role named “AWSServiceRoleForAutoScaling”
When you create an Auto Scaling group, you need PassRole permission to pass this role to Auto Scaling

Exam tips:

You can’t modify permissions in Service-Linked Roles
PassRole is crucial for security (prevents privilege escalation)
Services can only create Service-Linked Roles if they have permission
Some services create Service-Linked Roles automatically when you take certain actions

36
Q

Can you modify permissions in Service-Linked Roles?

A
  • No
  • Are predefined by AWS
37
Q

When is the root user on an account restricted?

A
  • When an SCP is attached to the act
  • Except the AWS Org MGMT Act
38
Q

How are SCPs inherited?

A
  • Inheritance downward
    * Root -> Mgmt -> OU -> Nested OU -> INdividual Act
    * Attached individually
39
Q

Do SCPs grant permissiosn? Or grant permissions to users?

A
  • NO
  • SCP are boundaries, they define the limitsof what is/isn’t allowed in the account
  • Identities must be granted permissions in the account to access resources
40
Q

What is the SCP default permissions?

A

Deny

41
Q

You use SCP in one of two ways?

A

Allow List vs. Deny List

42
Q

Explain SCP Allow vs. Deny?

A
  • Use Block by Default, then add certain services = which is called an “Allow List”
  • Use Allow by Default, then deny certain services = which is called an “Deny List”
43
Q

For SCPs, use Block by Default, then add certain services = which is called an?

A

“Allow List”

44
Q

For SCPs, Use Allow by Default, then deny certain services = which is called an ?

A

“Deny List”

45
Q

What is the defualt AWS Org SCP when a new account is created and SCP is enabled or attached?

A
  • Default “Deny List”
  • Use Allow by Default, then deny certain services
  • FullAWSAccess
46
Q

AWS Deny list uses which AWS policy by default?

A
  • FullAWSAccess
  • You must attached any services you want to deny
  • If FullAWSAccess, wasn’t attched, there would be no way to perform actions in the account
  • As AWS expands servcies, servcies are atomattacly allowed
47
Q

What is the two part process to use SCP “Allow List”?

A
    • Remove FullAWSAccess
  2. Then add the service or resource
  • “Allow List” cause more overhead
48
Q

In an AWS Act with SCP, what permissions are allowed?

A
  • Only permissions within the SCP
  • Only permissions within the Idenity Policies of the account

___3 - AWS SAA-C03_2024-1204 (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions