Security Flashcards
Cognito, IAM ..
How does Cognito use SAML 2.0 to support identity providers such as Google?
user clicks sign in
cognito sends a SAML request to Google
once authenticated
Google sends a SAML assertion back to Cognito which generates an ACCESS TOKEN for the user to access the app
What is the recommended approach for user sign in and sign up for mobile apps which allow user with FB, Amazon or Google credentials
Cognito
Identity pools
grant users TEMPORARY access to aws services
User pools
are directories that provide sign up and sign in options for users apps
one example is user pools in Cognito allow mobile app users to sign up, sign in, and manage their profiles securely within the app.
What is the primary method for granting cross account access?
IAM Roles because you don’t need to share credentials user just assumes the role
What does STS stand for and what is it used for
Secure Token Service
STS used when an app on an EC2 instance needs temporary access to resources in another AWS account, allowing it to request temporary security credentials for that access.
Which always wins deny or allow?
Deny, but permissions of role always overrule users permissions
What is the way to give access if app is running outside of AWS?
IAM roles with temporary security CREDENTIALS obtained through the AWS Security Token Service (STS).
What is Get Session Token?
An API that returns a set of temporary credentials (access key ID, secret access key and security token) for an AWS account or IAM user
Use if you want to use MFA
What is the most secure way to access AWS services?
IAM roles
How would you ensure containers could interact with dynamo db tables that are deployed in ECS?
Create an IAM role for ECS tasks
An app is making lots of calls to a dynamo db table.
Name 1 way you could minimise the read capacity being used by the queries?
Use global secondary indexes with projected attributes to help reduce the amount of read through put
What is the ideal way to store database passwords?
Store them as secrets in Secrets Manager
Your developing a mobile app.
Users will be authenticated by a third party (ie., Google) and would need TEMPORARY access to work with AWS resources
What action would you need to do this?
AssumeRoleWithWebIdentity
which returns a set of temporary security credentials for users who have been authenticated in an app with a WEB IDENTITY PROVIDER (ie., Google)
Give some examples of Web Identity Providers?
Google
Facebook
