Security Flashcards
IAM User Groups can contain other Groups
FALSE
What does an IAM Policy Statement Consist of ?
A statement in an IAM Policy consists of Sid, Effect, Principal, Action, Resource, and optionally Condition.
Version is part of the IAM Policy itself, not the statement.
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Sid”: “ListYourObjects”,
“Effect”: “Allow”,
“Action”: “s3:ListBucket”,
“Resource”: [
“arn:aws:s3:::bucket-name”
],
“Condition”: {
“StringLike”: {
“s3:prefix”: [
“cognito/application-name/${cognito-identity.amazonaws.com:sub}/*”
]
}
}
When to use SSM Paraeter Store.
Create a SecureString when you need to securly store key/value pairs using KMS with a single API.
Recomended Credentials for CodeCommit
Use Git credentials generated from IAM
CodeCommit repositories are Git-based and support the basic functionalities of Git such as Git credentials. AWS recommends that you use an IAM user when working with CodeCommit. You can access CodeCommit with other identity types, but the other identity types are subject to limitations.
The simplest way to set up connections to AWS CodeCommit repositories is to configure Git credentials for CodeCommit in the IAM console, and then use those credentials for HTTPS connections.
What is keypair used for
A key pair is used to enable remote ssh to an ec2 instance without credentials.
When you create the ec2, you specify the keypair. The public key is automatically added to ~/.ssh/authorized_keys when the instance is first booted.
When you connect , you specify the private key with your ssh command.
You only need this if connecting outside of aws. From console you can connect directly since you’re already authenticated.
If you want to create IAM for a lot of users but don’t want to explicitly create a new IAM every time you have a new user, how would you do this?
Policy Variables
Instead of creating individual policies for each user, you can use policy variables and create a single policy that applies to multiple users (a group policy). Policy variables act as placeholders. When you make a request to AWS, the placeholder is replaced by a value from the request when the policy is evaluated.
… “Resource”:
[“arn:was:s3::myBUcket/${aws.username”}/*]
What services can provide authentication mechanism that returns a JWT (JSON Web Token).
COGNITO USER POOLS
After successful authentication, Amazon Cognito returns user pool tokens to your app. You can use the tokens to grant your users access to your own server-side resources, or to the Amazon API Gateway.
Amazon Cognito user pools implement ID, access, and refresh tokens as defined by the OpenID Connect (OIDC) open standard.
The ID token is a JSON Web Token (JWT)
How does KMS Encryption Work?
KMS Stores the CMK (Customer Master Key) and receives data from the client, which it then ecrypts and sends back.
AWS KMS supports three types of CMKs: customer-managed CMKs, AWS managed CMKs, and
AWS owned CMKs.
Which secuirty credetnials can ONLY be craeted by the account ROOT user ?
CloudFront Key Pairs
Which is the only resource-based policy that the IAM service supports?
Trust Policy
Trust policy - Trust policies define which principal entities (accounts, users, roles, and federated users) can assume the role. An IAM role is both an identity and a resource that supports resource-based policies. For this reason, you must attach both a trust policy and an identity-based policy to an IAM role. The IAM service supports only one type of resource-based policy called a role trust policy, which is attached to an IAM role.
How to test IAM permissions ?
use AWS CLI with –dry-run or IAM Policy Simulator
COgnito User Pool v Idenity Pool
User pools are for authentication. Your app users can sign in through the user pool, or federate through a third-party identity provider (IdP).
Identity pools are for authorization. You can use identity pools to create unique identities for users, and give them access to other AWS services.
IAM v IAM Identity Centre for creating users
You can use both IAM and AWS IAM Identity Center to create new users or federate existing users into AWS. The main difference between the two is that IAM users are granted long-term credentials to your AWS resources while users in IAM Identity Center have temporary credentials that are established each time the user signs-in to AWS.
