Section 15 - Advanced IAM

Question 1

Web Identity Federation?

Answer 1

Simplifies authentication and authorization for web applications.

• User Access to AWS Resources
  
  • User access AWS resources after successfully authenticating with a web-based identity provider like Facebook, Amazon or Google
• Authentication
  
  • Following successful authentication users receive an authentication code from the web ID provider.
• Authorization
  
  • Users can trade this authentication code for temporary AWS security credentials, authorizing access to AWS resources.
• An authentication token (JWT token) is exchanged for temporary AWS credentials, allowing users to assume an IAM Role, with permissions to access AWS resources.

Question 2

Web ID Federation with Amazon Cognito?

Answer 2

• Amazon Cognito
  
  • Provides web ID federation, including sign-up and sign-in functionality for your applications, and access for guest users.
• Identity Broker
  
  • Manages authentication between your application and web ID providers, so you don’t need to write any additional code.
• Multiple Devices
  
  • Synchronizes user data for multiple devices.
• Recommended for Mobile
  
  • Recommended for all mobile applications that call AWS services.

Question 3

Amazon Cognito Use case?

Answer 3

Web Identity Federation Using Social Media Accounts Like facebook

• User has to access your ecommerce site which is using both S3 and DynamoDB
• Step1: User authenticates with Facebook
• step2: Once authenticated successfully with facebook, Cognito will grant temp AWS credentials to the AWS resources used by the ecommerce website.

Question 4

Authentication with Amazon Cognito?

Answer 4

• Temporary Credentials
  
  • Cognito brokers between the app and Facebook, Amazon, or Google to provide temporary credentials.
• IAM Role
  
  • The temporary credentials map to an IAM role, Allowing access to the required resources.
• Secure and Seamless
  
  • No need for application to embed or store credentials locally on the device.
  • Cognito gives users a seamless experience across all devices.

Question 5

Cognito User Pools and Identity Pools?

Answer 5

• User Pools (For sign-in or sign-up)
  
  • User directories used to managed sign-up and sign-in functionality for mobile and web applications.
• Sign-in
  
  • Users can sign-in directly to User Pool, or using Facebook, Aamazon, or Google.
• Identity Pools(For temp credentials)
  
  • Identity Pools enable you to provide temporary AWS credentials Enabling access to AWS services like S3 or DynamoDB.

Question 6

Cognito Push Synchronization?

Answer 6

Synchronization Across Devices.

• Devices
  
  • Cognito tracks the association between user identity and various different devices they sign-in from
• Seamless
  
  • Cognito uses Push Synchronization to [ush updates and synchronize user data across multiple devices.
• SNS Silent Notification
  
  • SNS notification to all the devices associated with a given user identity whenever data stored in the cloud changes.

Question 7

Advanced IAM Policies?

Answer 7

• Used to define user acess permissions within AWS
• IAM has the following Policies:
  
  • AWS Managed Policies
  • Customer Managed Policies
  • Inline Policies

Question 8

AWS Managed Policies?

Answer 8

An IAM policy created and administered by AWS.

e.g. AmazonDynamoDbFullAccess, AWSCodeCommitPowerUser

• Assign appropriate permissions to your users without having to write the policy yourself.
• Attach to muliple users, groups or roles in the same AWS account or across different accounts.
• You cannit change the permisisons defined in an AWS managed policy.

Question 9

Customer Managed Policies?

Answer 9

• Created by You
  
  • A standalone policy that you create and administer inside your own AWS account. You can attach this policy to multiple users, groups , and roles within your own account.
• Copy an Existing Policy
  
  • In order to create a customer managed policy, you can copy an existing AWS managed policy and customize it to fit the requirement of your organization.
• Your needs
  
  • Recommended for use cases where the existing AWS managed policies don’t meet the needs of your environment.

Question 10

Inline Policies?

Answer 10

• 1:1 Relationship
  
  • There is a strict 1:1 relationship between the entity and the policy
• Embedded
  
  • When you delete the user, group, or role in which the inline policy is embedded, the policy will also be deleted.
• Single User, Group or Role
  
  • The policy must not be inadvertently assigned to any other user, group, or role than the one for which it is intended.
  • The policy must only ever be attached to a single user, group, or role.
• NB: In most cases, AWS recommends using managed policies over inline policies.

Question 11

STS AssumeRoleWithWebIdentity?

Answer 11

• Security Token Service API Call
• STS API
  
  • assume-role-with-webidenity is an API provided by STS (Security Token Service)
• Temporary Credentials
  
  • Return temporary security credentials for users authenticated by a mobile or web application or using a web ID provider like Amazon, facebook, Google etc..
• Web Applications
  
  • Regular web applications can use the assume-role-with-web-identity API. For mobile applications, Cognito is recommended.
• Exam Tips:
  
  • Authentication
    
    • Allows users who have authenticated with a web identity provider to access AWS resources
  • API Call
    
    • After the user has authenticated, the application makes the assume-role-with-web-identity API call
  • Temporary Credentials
    
    • If successful, STS will return temporary credentials enabling access to AWS resources.
  • AssumeRoleUser
    
    • Within AssumeRoleUser, the ARN and AssumedRoleID are used to programmatically reference the temporary credentials, not an IAM role or user.

Question 12

Cross-Account Access?

Answer 12

• Delegate access to resources in different AWS accounts that you own.
• Managed Resources in Other Accounts
  
  • Share resources in one account with users in a different account.
• IAM Role
  
  • Create a role in one account to allow access and grant permissions to users in a different account.
• Switch Roles
  
  • Switch roles withon the AWS management console. No password is required.

Question 13

Cross-Account Access Use Case?

Answer 13

Dev account needing access to the Production account resources, e.g. processing historic data in s3.