IAM, STS and Encryption Flashcards
We are setting up a lambda function which needs to communicate with a database by providing a user ID and a password. We need to encrypt these values so we have set up a CMK in KMS called ‘CipherDbConnectionValues’. In our environment variables section in Lambda we have selected encrypt in transit helpers, and the ‘CipherDbConnectionValues’. It appears that the encrypt side has worked, however when we call Decrypt in our lambda code we receive a message in the logs stating:”An error occurred (AccessDeniedException) when calling the Decrypt operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.We have checked the region and the key exists - what is wrong?
We need to give our lambda function permission in IAM to allow it call the Decrypt operation on the CipherDbConnectionValues key.
I am creating an s3 buckey for my users within my organisation. I want to leverage IAM to do this. When I only had 2 users, this was simple as I created an IAM policy for each user assigning them R+W permission on a folder in my bucket - i.e. home/scott, home/sam. We are expanding however and are likely to 10’s to 100’s of staff and this is going to become unwieldy. How can I use IAM to assign permissions to a users folder WITHOUT creating multiple IAM policies?
You would use policy variables, specifically the ${aws:UserName} variable:”Action”:[“s3:”],”Effect”:”Allow”,”Resource”:[“arn:aws:s3:::the-bucket/home/${aws:username}/”]
When using GetSessionToken with STS to return an MFA token, what FOUR things does the call return?
Session Token
Access Key
Secret Access Key
ExpirationDate
What is envelope encryption?
With envelope encryption, the key used to encrypt the message is itself encrypted with another key. The other key is the client master key managed by AWS KMS
At a high level, what three things are needed to encrypt data?
- Some data to encyrpt2. A method to encrypt the data3. A crypto alogorithm
In server side encryption, only the encryption happens on the server. Where does the decryption happen?
Also on the server
What is the maximum amount of data that can be encrypted by KMS per call? If I need to encrypt more data than this, what do I need to do?
4KB. If we need to encrypt more data then we will need to use GenerateDataKey and encrypt the data locally
What does the Encrypt API do with respect to KMS and what is the maximum size of data we can encrypt?
Encrypt API is used to encrypt up to 4KB using a CMK
If I delete my IAM principal, what happens to any inline IAM policies assigned to that principal?
The inline policies will be deleted.
Assume I have an EBS volume in eu-west-2. This volume is encrypted with KMS Key A. I need to copy this volume to AP-SouthEast2. What do I need to do?
You can’t use Key A in ap-southeast2 as keys are region locked. You would need to take a snapshot of the EBS volume using Key A, and then copy to ap-southeast2 while re-encrypting with a key from ap-southeast2. You can then restore the snapshot using the ap-southeast2 key.
How many physical users can you have per IAM user?
ONE
Which encryption type does AWS use for encrypt/decrypt and sign/verify operations?
Asymmetric
You have been granted access (IAM) to an AWS parameter store and can retrieve an encrypted password. However when you try to decrypt the password, you get an error. Why?
IAM will get you access to the store - but you also need IAM permissions to KMS for decryption.
Where are AWS SSO user permissions and access managed from?
AWS Organisations.
What is the maximum size for an IAM policy? What impacts could this have?
2KB. This means if you are using inline policies, you run the risk of exceeding this size
Can policy use be audited?
Yes, this allows you to see who has been using the policy and what they have done
We have an IAM policy that allows principal * to stop and terminate EC2 instances. In this policy, there is a statement:”condition”:{“Bool”:{“aws:MultiFactorAuthPresent”: “true”}}What does this condition enforce, and what STS call would be used to return this policy?
This would be an StsGetSessionToken call as the MultiFactorAuthPresent condition requires the use of MFA to either stop or terminate an instance.
With KMS, do you ever get access to the key unencrypted?
No. You never get access to the key unencrypted and all crypto ops need to be done via the KMS API
In terms of encryption - does SSE-S3 use KMS?
No. In SSE-S3 encryption is handled by S3 - NOT KMS.
Can IAM policies be versioned?
Yes
How is a policy defined (in terms of language) ?
JSON
If you don’t provide a specific KMS key policy when you create a key - what policy is created by default which user has access and what are the implications of this? Can a service such as cloud watch use the default key?
The default Key policy is created with access granted to the root user - which means users or roles in the entire AWS account can use the key. A service cannot by default use the default key policy as only users and roles have access.
Can you access the unencrypted private key used for asymmetric encryption within AWS?
No.
Where are Custom Key Stores stored in AWS (hint, not s3 or ebs) - think outside the box. Is this single or multi tennanted?
Single tenant CloudHSM
What is a managed policy?
A predefined IAM policy created by Amazon
What are the 3 IAM components?
Users, Groups, Roles
