Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Security Certification > Identity Access Management & S3 > Flashcards

Identity Access Management & S3 Flashcards

1
Q

What is a principal in IAM ?

A

A principal can be a user, role, federated user, aws account or a service within or external to the organisation but not a group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the relationship between principals and resources ?

A

Principals perform actions on resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Is IAM a global or a regional service ?

A

Global - designed to be a one stop shop for all IAM related activity so to stop a proliferation of differing regional IAM solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an IAM User?

A

These are your day to day users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a root user ?

A

Privileged User

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are IAM groups ?

A

A collection of users with common permissions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are roles ?

A

The ability to give temp access credentials to either a service or a user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a principal-based policy in IAM ?

A

Access is limited to a group of principals and attached to the principals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a resource based policy ?

A

Attached to the resource and restricts access to the listed principals ?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the difference between a resource based policy and an principal based policy ?

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the principal of least privilege ?

A

It is the minimum amount of access a principal (subject) needs to access a resource (object) to do their job

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why do microservices offer a better security model over monolithic applications ?

A

Microservices are modular and can have specific credentials to access modular parts of the whole solution. If compromised the attacker would have a smaller attack plane than with a monolithic application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

In IAM policies what does PARC-E represent ?

A

P - principal the who or what is allowed access
A - action what the statement applies to
R - Resources that the statement is applicable for
C - Conditions
E - Effect whether the statement is to allow or deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a principal based policy in IAM ?

A

Principal based policies are applied to a user, group or role. The resource being accessed can be within the same account or a different account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What in IAM is the default deny rule ?

A

By default the principal is denied access unless it is explicitly given

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a resource based policy ?

A

It is attached to a resource and list the principals that have access or not to the resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

I want to specify a group as a principal in a trust policy on a role is this possible ?

A

No a group is not an IAM principal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A user who had previously access to you root credentials for your account has left what should you do to protect the root account. (Clue there are five items) ?

A
  1. Logon as root.
  2. Change Passwords.
  3. Delete and re-install MFA.
  4. Delete any programmatic access - Root should not have programmatic access.
  5. Review any IAM accounts that user has access to.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the three types of policies in IAM ?

A
  1. Customer Managed
  2. AWS Managed
  3. Inline
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Can AWS Managed policies change ?

A

Yes but these changes are carefully controlled.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Why might you use a customer managed policy ?

A

You may not want to risk AWS changing a AWS managed policy and having that affect your accounts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the use case for an IAM inline policy ?

A

You may want a very specific policy attached to a particular user and you dont want to run the risk of having a policy that can be attached to many users.

23
Q

Why would you use a S3 Bucket policy ?

A

Ease of administration

Bucket Policies can be a bigger size (20kb) than IAM (10Kb)

Way of giving cross account access without using roles

24
Q

In a bucket policy in the reources section I paste my bucket arn but still get an error why ?

A

You need the arn followed by a path such as /*

25
Q

What are the main differences IAM policies, S3 bucket policies and S3 Acls

A

Scope - IAM affects the whole platform, bucket policies the bucket and acl the objects within the bucket

26
Q

What happens if a user has access to everything in S3 but there is a specific deny on a S3 bucket

A

Deny wins for that bucket

27
Q

What should you use if you want to apply permissions on individual items within an S3 bucket?

A

ACLS

28
Q

Besides fine grained access to infividual files what is another use case for ACLs ?

A

If the bucket policy is close to hitting its maximum of 20kb

29
Q

With ACLs can I let other accounts have access to individual S3 objects ?

A

Yes

30
Q

Can I assign acls to individual users via the console ?

A

No you need to use the canonical user id with aws-cli or sdk

31
Q

When a principal issues a command to s3 how are security policies evaluated ?

A

As a union of ACL, IAM and Bucket policies an explicit deny overrides an allow

32
Q

If you dont specify an allow on an s3 bucket was is the default access ?

A

Deny

33
Q

Under what circumstances will an allow to an S3 bucket be allowed ?

A

If there are no explicit denies and there is at least one explicit allow

34
Q

What is the principal of least privilege ?

A

It is achieved by following the rules

  1. Give the right access
  2. Only to the right individuals
  3. To perform the right action
  4. Only when the time is right
35
Q

Why do microservices lend themselves to the Principal of Least Privelege better than monoliths ?

A

A microservice does one thing well and we can give it access to do just that one thing rather than everything

36
Q

What is the default rule for IAM ?

A

Default Deny - So when a user is added account they will have no access to resources

37
Q

How does the zone of trust work with single account access in IAM ?

A

If a principal within the same account as the resource it wants access to then IAM policies on their own are enough to grant access

38
Q

How does the zone of trust work with cross account access ?

A

In a cross account access you need both an IAM policy in the asking account and a resource based policy in the account that has the resource

39
Q

What is the general format of IAM Conditions

A

“Condition” : { “{condition-operator}” : { “{condition-key}” : “{condition-value}” }}

40
Q

What are the six string operator conditions in IAM

A
  1. Stringlike
  2. StringNotLike
  3. StringEquals
  4. StringNotEquals
  5. StringEqualsIgnoreCase
  6. StringNotEqualsIgnoreCase
41
Q

What are condition keys ?

A

conditions fire on operators which test that a condition key has or does not have a certain value. Each service has thier own condition keys

https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-policy-keys

42
Q

What are the three sources of users that come to STS

A

Cross Account, Federation or Web Federation

43
Q

In Federated environments do users have to exist in AWS ?

A

No just Active Directory

44
Q

What does an Identity Broker authenticate against first STS or Identity Store

A

Identity Store

45
Q

What are the four items returned by STS ?

A

Secret Access Key, Access Key, Duration (1 - 36 hours) and Token

46
Q

Does cognito support the idea of guest users ?

A

Yes

47
Q

How does Cognito work ?

A

A user logs into the user pool either directly or with a web provider such as Facebook and recieves as JWT token that they can exchange for an identity from the identity pool which gives them access to AWS Resources.

48
Q

What is a Glacier vault ?

A

A collection of archives which are tar files containing one or more files

49
Q

What are the common use cases for a vault lock policy ?

A

A write once read many policy or creation of date retention rules to enforce compliance

50
Q

What is the process for using a vault lock policy ?

A

Write Policy

Attach Policy to Vault

Verify its working (24 hours to change)

Once validated policy is immutable and cant be changed

51
Q

Can SCPs be used to grant access ?

A

No

52
Q

Can SCPs be used to create permissions boundaries ?

A

Yes by overrriding local settings we can use them to enforce compliance

53
Q

What does the IAM Credential Report show ?

A

CSV Report that lists all the users in your account

Shows MFA enabled, Access Key Rotation and Password Used and rotation.

54
Q

What two permissions do you need to interact with an IAM Credential Report ?

A

GetCredentialReport, GenerateCredentialReport

AWS Security Certification (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions