IAM 1

Question 1

Root User

Root user restrictions?

Answer 1

Can’t be restricted in any way

Question 2

Root User

How do you change your account name or contact info?

Answer 2

Must use root creds

Question 3

Root User

How do you turn on IdentityCenter?

Answer 3

Must use root creds

Question 4

Root User

How do you join the GovCloud region?

Answer 4

Must use root creds, prove you’re a US Person

Question 5

Root User

How do you close your account?

Answer 5

Must use root creds

Question 6

Root User

How do you turn on MFA delete on an S3 bucket?

Answer 6

Must use root creds

Question 7

Root User

How do you fix an S3 bucket policy that denies all users?

Answer 7

Must use root creds

Question 8

Root User

Best Practice for root user?

Answer 8

Use MFA, delete access keys, regularly change password, set security challenge questions

Question 9

Root User

What are the security challenge questions used for?

Answer 9

Contacting AWS Support

Question 10

Root User

Is the root user’s password subject to your account’s password policy?

Answer 10

no

Question 11

Limits

Max IAM Users per account?

Answer 11

5,000

Question 12

Groups

Max groups an IAM User can be in?

Answer 12

10

Question 13

Groups

What happens if an IAM User is in two groups with overlapping Policies?

Answer 13

Union: if any denies, deny. Then, if any allow, allow it.

Question 14

Groups

What’s the “all users” group that all IAM Users belong to?

Answer 14

There is none.

Question 15

Groups

Limit on the number of users in a group?

Answer 15

None. However, it’s 5,000: max users per account.

Question 16

Groups

Can you nest groups?

Answer 16

no

Question 17

Groups

Max number of groups per account?

Answer 17

300 (soft limit)

Question 18

Groups

Extend the max number of groups per account?

Answer 18

Yes, request limit increase form (not a support case!)

Question 19

Groups

How do you set up a Policy for everyone in a group?

Answer 19

Create a single Group Policy (duh).

Question 20

Groups

Reference a Group in a Policy?

Answer 20

Not allowed: Groups aren’t Principals. Can’t be targets of policy things.

Question 21

Groups

Can groups have inline, customer-managed, or aws-managed policies?

Answer 21

All three

Question 22

Groups

When shouldn’t you add an inline policy to a user?

Answer 22

Hopefully never: manage human perms always via Groups.

Question 23

Groups

Can’t use Groups, too many different sets of perms!

Answer 23

Refactor your Groups, grant multiple Groups to each Human.