Security Flashcards
1
Q
S3 IAM Policy
A
- Applies to the user level
- “User” policy
- can create multiple users and give them the same policy or different policies
- can not grant anonymous users
- can attach or detach
2
Q
Bucket policy
A
- Applies to the resource level
- - “resource-based “ policy
3
Q
Bucket permissions
A
specify:
- -who is allowed to access resources
- what that user can do with those resources
- full permissions to the owner of a resource
- resource owner can grant access to others, even cross-account regardless of who owns them.
4
Q
Bucket Policies
A
- Resource-based policy
- Uses a JSON file attached to the resource
- can grant other AWS accounts or IAM users permission for the bucket and objects inside.
- should be used to manage cross-account permissions for all Amazon S3 permissions
- limited to 20KB in size.
5
Q
ACLs
A
- stands for access control list
- used for both buckets and objects
- grant read/write permissions to other AWS accounts
- you can not grant conditional permissions
- you cannot explicitly deny permissions
- an object ACL is the only way to manage access to objects not owned by the bucket owner
- use XML format
6
Q
S3 Bucket Policies
A
Resources
– used to identify resources with ARNs
Actions
– an explicit deny always overrides an explicit allow
Effect
– defines whether to allow or deny the above action
Principal
– an account or user that this policy applies to
– specific to s3 bucket policies, not user policies
7
Q
MFA
A
- A security method that requires multiple separate authentications
- One authentication option we have with AWS uses time-based codes
8
Q
Shared Responsibility – User responsibility
A
- IAM(Identity and Access Management)
- MFA
- Password/Key Rotation
- Access Advisor
- Trusted Advisor
- Security Groups
- ACL(resource-based policies)
- -VPC
9
Q
AWS responsibility
A
- Physical server level and below
- Physical environment security and protection –fire/power/climate/management
- storage device decommissioning according to industry standards.
- network Device Security and ACL’s
- API access endpoints use SSL for secure communication
- DDOS protection
- EC2 instances cannot send spoofed data
- Port scanning against rules even if it’s your own environment
- personal access to facilities
10
Q
EC2 instance hypervisor isolation
A
– independent of each other.
11
Q
AWS auditing – AWS provides
A
- information regarding their global infrastructure
- From the host operating system and virtualization layer down to the physical security of facilities.
- AES provides annual certifications and reports.
12
Q
AWS auditing - customer provides
A
- anything their organization puts on(or connects to) their AWS assets.
- examples: guest OS, apps on virtual machine instances, objects in S3, database like RDS, etc…
