Identity & Access Management

Question 1

IAM

Answer 1

allows you to create users, roles, groups, permissions, and monitor access of AWS to users and groups

Question 2

How is IAM structured

Answer 2

Like a user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. Instead of being uniquely associated with one person, however, a role is intended to be assumable by anyone who needs it

Question 3

MFA

Answer 3

Can Leverage MFA as second layer of authentication such as YubiKey or RSA token

Question 4

3 ways to use/access/interact with AWS?

Answer 4

1. AWS Management Console – easy to use graphical interface
2. Command Line Interact/Programmatic Access – enable access key ID and Command Line
   • allows you to work with AWS resources
   programmatically
   • access to services by discrete command
3. Software Developers Kit (SDK) – used with an API, access service in code like python

Question 5

When you create IAM policies

Answer 5

always grant the least privilege access needed for an employee for security reasons

Principle of Least Privilege
- Policies are always written in Java Script
- Root Account = email address you used
to setup your AWS Account (full admin
access)
- Roles are always universal and you can
use them in any region around the world

Question 6

Tags

Answer 6

Key value pairs attached to AWS resources that contain metadata
- Tags can be inherited

Question 7

Specific Information for Tags

Answer 7

• EC2 = Public and Private IP Addresses
• ELB = Port Configurations
• RD = Database Engine

Question 8

Tag Editor

Answer 8

global service that allows us to discover resources and to add additional tags to them

Question 9

Cost Allocation

Answer 9

a tag you can use to track your AWS cost on a detailed level

Question 10

Resource Groups

Answer 10

make it easy to group your resources using the tags that are assigned to them

• Group = place to store users (to set
  permissions for groups, you need to apply
  a policy to that group)
• Can contain: Region, name, Employee ID,
  Department
• You can group resources that share one or more tags
• You can apply automation to resources tagged with specific tags
• Resource Groups with AWS Systems Manager allow you to control and execute automation against entire fleets of EC2 Instances, all with the push of a button