IAM - Identity Access Management

Question 1

AWS IAM (Identity Access Management)

Answer 1

Is a web service that helps you securely control access to AWS resources. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.

Question 2

IAM - Password Policy

Answer 2

-Strong passwords
-Setup a password policy
-Allow all IAM users to change their own passwords
-Password expiration
-Prevent password re-use

Question 3

Multi Factor Authentication (MFA)

Answer 3

It’s a second authentication factor in addition to user name and password sign-in credentials.

Question 4

MFA devices options in AWS

Answer 4

-Virtual MFA Device (Apps)
-Universal 2nd Factor (U2F) Security Key
-Hardware Key Fob MFA Device
-Hardware Key Fob MFA Device for GovCloud

Question 5

How can users access AWS ?

Answer 5

-AWS Management Console - Protected by password + MFA
-AWS CLI - Protected by access keys
-AWS SDK- for code: Protected by access keys

Question 6

What’s the AWS CLI?

Answer 6

A tool that enables you to interact with AWS services using commands in your command-line shell

Question 7

What’s the AWS SDK?

Answer 7

Enables you to access and manage AWS services programmatically

-Embedded within your application

Question 8

IAM Roles

Answer 8

An IAM role is an IAM identity that you can create in your account that has specific permissions.

You can use roles to delegate access to users, applications, or services that don’t normally have access to your AWS resources.

Question 9

IAM Users

Answer 9

Is an entity that you create in AWS to represent the person or application that uses it to interact with AWS.

Question 10

IAM Security Tools

Answer 10

-IAM Credentials Report (account-level) = a report that lists all your account’s users and the status of their various credentials.
-IAM Access Advisor (user-level) = Access advisor shows the service permissions granted to a user and when those services were last accessed. You can use this information to revise your policies

Question 11

IAM Best Practices

Answer 11

-Don’t use the root account except for AWS account setup
-Create a strong password policy
-Use MFA /// - Use access keys for CLI-SDK
-Create roles for giving permissions for AWS services
-Audit permissions with the IAM Credentials Report

Question 12

IAM Section - Summary

Answer 12

-Users / Groups / Roles
-Policies (JSON document)
-Security (MFA)
-AWS CLI / AWS SDK
-Access keys
-Audit with IAM CR & IAM AA

Question 13

AWS CloudShell

Answer 13

Is a browser-based shell that makes it easy to securely manage, explore, and interact with your AWS resources.