Week 2: Cloud Computing Foundations Flashcards
What is the difference between authentication and authorization in AWS IAM?
Authentication is the process of verifying who you are—for example, by using a username, password, and possibly multi-factor authentication. It answers the question “Who are you?”
Authorization is the process that determines what you are allowed to do after your identity is verified. It answers the question “What are you allowed to do?”
How does the Principle of Least Privilege improve security in IAM?
The Principle of Least Privilege means granting users only the minimum permissions necessary to perform their tasks. This minimizes the risk of accidental or malicious misuse of privileges and reduces the potential damage from a compromised account.
By starting with a limited set of permissions and only granting additional rights as needed, organizations reduce their attack surface and simplify compliance with security policies.
What are IAM users?
These are identities created for individual people or applications. Each IAM user has long-term credentials (passwords or access keys) and is meant to represent a single entity.
What are IAM Groups?
A group is a collection of IAM users. Instead of assigning permissions individually, you attach policies to the group. This makes it easier to manage permissions for many users simultaneously
What are IAM Roles?
Roles are identities that are not permanently associated with a specific person. Instead, roles can be assumed temporarily by users or services to perform specific tasks. They come with temporary credentials and are useful for scenarios like cross-account access or when a service needs to act on your behalf.
How do IAM users, groups, and roles differ in managing access?
These differences allow organizations to manage access in a scalable and secure way: direct credentials for individual use (users), bulk policy assignment (groups), and temporary privilege elevation (roles).
What are IAM policies?
JSON documents that define what actions an identity can or cannot perform on which resources. They contain elements like actions, resources, effects (allow or deny), and optional conditions.
What is the difference between the identity-based and resource-based policies?
Identity-Based Policies:
These are attached to IAM identities (users, groups, or roles). The policy’s permissions are implied for that identity without explicitly stating who the principal is.
Resource-Based Policies:
These are attached directly to a resource (such as an S3 bucket or SQS queue). They include a principal element that specifies which identities (or accounts) are allowed to access the resource.
What are best practices for managing IAM policies?
Least Privilege:
Always grant only the minimum permissions required for users and services to perform their tasks.
Policy Organization:
Use managed or customer-managed policies attached to groups or roles rather than individual inline policies to simplify administration.
Monitoring and Auditing:
Utilize tools like IAM Access Analyzer and Access Advisor to review permission usage and ensure that policies are not over-privileged.
Regular Review:
Periodically review and update policies to adapt to changing requirements and to remove unnecessary permissions.
What is an AWS account, and how does it serve as a container for cloud resources and identities?
An AWS account is the primary container in AWS that holds all your Cloud resources (such as EC2 instances, S3 buckets, Lambda functions, etc.) and the associated IAM identities (users, groups, roles).
It establishes a boundary for resource management, billing, and security, ensuring that all resources within an account are managed and governed under a unified set of policies.
How do AWS accounts support different environments?
A common design pattern is to use separate AWS accounts for different environments such as development, staging, and production.
This segregation isolates resources and permissions, helps manage costs and quotas independently, and improves security by reducing the blast radius if an environment is compromised.
How does AWS IAM compare to similar structures in other cloud platforms like GCP and Azure?
While AWS uses IAM within its account structure, other cloud providers have similar—but not identical—mechanisms:
Google Cloud Platform (GCP): Uses “projects” as the basic container for resources.
Microsoft Azure: Uses “resource groups” (along with subscriptions and management groups) to organize resources.
Additionally, AWS IAM is not a pure role-based access control (RBAC) system since it incorporates users with long-term credentials, whereas GCP and Azure lean more towards a pure RBAC model.
What are the components of IAM Roles?
Trust Policy:
Defines who (which principals) is allowed to assume the role.
Permissions Policy:
Specifies what actions the role is allowed to perform once assumed.
What are IAM roles and why are they important?
IAM Roles are identities that provide temporary access to AWS resources. Roles are important because they enable temporary, least-privilege access for users and services and help improve security by avoiding long-term credential distribution.
What are the different types of IAM roles and their differences/use cases?
Service Roles:
These are used by AWS services (for example, EC2 instance profiles) to perform actions on your behalf. They avoid the need to hard-code long-term credentials in applications.
Cross-Account Roles:
Allow users or services from one AWS account to access resources in another account. They enable secure collaboration between different accounts.
Roles for Federated Access:
Enable users authenticated by external identity providers to assume roles and access AWS resources without needing an IAM user in the account.
What is the purpose of temporary security credentials?
Temporary security credentials are designed to provide short-term access to AWS resources. They reduce the risk associated with long-term credentials by automatically expiring after a set duration (typically between 1 to 12 hours).
How does the AssumeRole API, STS allow for authorization?
The AssumeRole API (provided by AWS Security Token Service, or STS) is used to:
Allow a principal (user, role, or service) to assume a role.
Generate temporary credentials that grant the permissions defined in the role’s policy.
What is Federated Identity?
Federated Identity refers to using an external identity provider (such as Active Directory, Google, or Facebook) to authenticate users. Once authenticated externally, users can exchange their authentication token for temporary AWS credentials via STS.
This setup supports single sign-on (SSO) and eliminates the need to create separate IAM users for external or third-party identities, thereby simplifying user management and improving security.
Define VPC
Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider’s network. It allows you to define your own private network in the cloud, similar to having your own dedicated physical network infrastructure
What are the Key Characteristics of VPCs?
Region Association: A VPC is created within a specific region (for example, AWS’s us-east-1).
IP Address Range: When creating a VPC, you define an overall IP address range using CIDR (Classless Inter-Domain Routing) block notation.
Multiple VPCs: By default, you can have up to five VPCs per account, though these can be increased upon request.
Isolation: The VPC isolates your network resources from other customers’ networks, ensuring security and control
Define VPC Subnets
Subnets are logical subdivisions within a VPC that partition the overall CIDR block into smaller segments. They help organize and isolate resources based on their function or security needs. Each subnet is assigned a smaller CIDR block that is a subset of the VPC’s IP address range. Each subnet is associated with one specific Availability Zone (AZ) within an AWS region
What are the Types of VPC Subnets?
Public Subnets: Have a route in their routing table to an Internet Gateway (IGW), allowing direct Internet access.
Private Subnets: Lack a direct route to an IGW; typically, they access the Internet via a NAT gateway or instance for outbound traffic only.
Why Does Each VPC Subnet only have one associated availability zone?
High Availability: Spreading resources across multiple availability zones reduces the risk of simultaneous failures.
Fault Tolerance: Since availability zones are isolated from one another, placing critical resources in different zones increases resilience.
What are the types of VPC Gateways?
Internet Gateway: Connects a VPC to the Internet. An IGW is attached to the VPC (not directly to a subnet) and is referenced in routing tables to enable public subnets to send and receive traffic over the Internet.
NAT Gateway/Instance: Allows instances in private subnets to initiate outbound traffic to the Internet while preventing inbound connections from the Internet. A NAT instance is an EC2 instance you manage, whereas a NAT gateway is a managed service by AWS that offers higher bandwidth and easier management.
Virtual Private Gateway: Enables site-to-site VPN connections, letting you securely connect your on-premises network to your VPC.
