Section 4b: IAM - Identity Access Management

Question 1

What are the 3 ways to access AWS?

Answer 1

1. AWS Management Console (protected by password + MFA)
2. AWS Command Line Interface (CLI): protected by access keys
3. AWS Software Developer Kit (SDK) - for code: protected by access keys

Question 2

What’s the AWS CLI?

Answer 2

A tool that enables you to interact with AWS services using commands in
your command-line shell

Question 3

What’s the AWS SDK?

Answer 3

AWS Software Development Kit (AWS SDK)

Question 4

What is AWS Cloudshell?

Answer 4

A CLI within the cloud of AWS that gives the user access to a full repository.

Question 5

What is an IAM Role?

Answer 5

A role that allows AWS entities to perform actions on behalf of the user.

Question 6

What are the 2 IAM Security Tools?

Answer 6

1. IAM Credentials Report (account-level)
2. IAM Access Advisor (user-level)

Question 7

IAM Credentials Report is

Answer 7

a report that lists all your account’s users and the status of their various
credentials

Question 8

IAM Access Advisor is

Answer 8

A feature that shows the service permissions granted to a user and when those services were last accessed.

Question 9

IAM best practices

Answer 9

• Don’t use the root account except for AWS account setup
• One physical user = One AWS user
• Assign users to groups and assign permissions to groups
• Create a strong password policy
• Use and enforce the use of Multi Factor Authentication (MFA)
• Create and use Roles for giving permissions to AWS services
• Use Access Keys for Programmatic Access (CLI / SDK)
• Audit permissions of your account using IAM Credentials Report & IAM
  Access Advisor
• Never share IAM users & Access Keys

Question 10

What is AWS responsible for according to the Shared Responsibility Model for IAM?

Answer 10

• Infrastructure (global
  network security)
• Configuration and
  vulnerability analysis
• Compliance validation

Question 11

What is the user responsible for according to the Shared Responsibility Model for IAM?

Answer 11

• Users, Groups, Roles, Policies
  management and monitoring
• Enable MFA on all accounts
• Rotate all your keys often
• Use IAM tools to apply
  appropriate permissions
• Analyze access patterns &
  review permissions