IAM Identity and Access Management Flashcards
What does IAM stand for
Identity and Access Management, Global Service
What account should not be used
The Root account
When should you use the root account
When setting up your account
What are users
People within your org. and can be grouped
Can groups contain other groups?
No just users
what is the version variable in a IAM policy
Details about the version of the policy, awlways include “2012-10-17”
What is the id variable in the IAM policy structure
an identifier for the policy (optional)
What is the statement in a IAM Policy structure
one or more individual statements (required)
What is the SID in a statement of a IAM Policy Structure
an identifier for the statement (optional)
What is the SID in a statement of a IAM Policy Structure
Whether the statement allows or denies access (Allow, Deny)
What is the Principal in a statement of a IAM Policy Structure
account/user/role to which this policy applied to
What is the Action in a statement of a IAM Policy Structure
List of actions this policy allows or denies
What is the Resource in a statement of a IAM Policy Structure
List of resources to which the actions applied to
What is the Condition in a statement of a IAM Policy Structure
Conditions for when this policy is in effect (optional)
In AWS how can you setup a password policy
Requiring a minimum password length Require specific character types like -including uppercase letter -lowercase letters -numbers -non-alphanumeric characters Allow all IAM users to change their own passwords Require users to change passwords Prevent password re-use
What is the main benefit of MFA
If a password is stolen or hacked, the account is not compromised
What is a Virtual MFA device
uses a software application to generate an authentication code.
What are the two virtual MFA devices used for AWS
Google authenticator and Authy
What is a universal 2nd factor (U2f) Security Key
A physical device that holds a security key
What are the two MFA devices for aws
Hardware Key Fob MFA device and GOVCloud Hardware Key Fob
What are the three ways to access AWS
Aws Management Console
AWS CLI
Aws Software Developer Kit
How are Access Keys generated?
Through the AWS console
What is the Access Key ID for
Username
What is the secret Access Key for
password
What is the AWS CLI
A tool that enables you to interact with AWS services using commands in your command-line shell
Where can you develop scripts to manage your resources
in the AWS CLI
What are common roles in AWS
EC2 Instance roles
Lambda Function Roles
Roles for CloudFormation
What are IAM roles
is an IAM identity that you can create in your account that has specific permissions
What are the two most common IAM Security Tools
IAM Credentials Report -
IAM Access Advisor
What is the IAM Credentials Report
A report that lists all your accounts users and the status of their various credentials
what is the IAM Access advisor
Shows the service permissions granted to a user and when those services were last accessed
You can use this information to revise your policies
What are The IAM Guidelines and Best Practices
Dont use the root account except for AWS account setup
One physical user = One AWS user
Assign users to groups and assign permissions to groups
Create a strong password policy
Use and enforce the use of MFA
Create and use roles for giving permissions to AWS services
Use Access Keys for Programmatic Access (CLI/SDK)
Audit permissions of your account with the IAM Credentials Report
Never share IAM users and Access Keys
What responsibilities does AWS have
Infrastructure (global network security)
Configuration and vulnerability analysis
Compliance validation
What responsibilities do you have as a IAM user
Users, Groups, Roles, Policies management and monitoring
Enable MFA on all accounts
Rotate all your keys often
Use IAM tools to apply appropriate permissions
Analyze access patterns and review permissions
What is a user
mapped to a physical user, has a password for AWS COnsole
What are groups
Container for users only
What are policies
JSON document that outlines permissionses for users or groups
What are Roles for
EC2 instances or AWS services
How do you implement Security
Security MFA + Password policy
What is the AWS CLI
manages your aws services using the command line
What is the AWS SDK
Manage your AWS services using a programming language
What are Access Keys
Passwords that allows access AWS through the CLI or SDK
What is an audit IAM
Credential Reports and IAM Access Advisor
