IAM 101

Question 1

What does IAM stand for?

Answer 1

Identity Access Management

Question 2

What are the Key Features of IAM

Answer 2

1. Centralized Control of your AWS account
2. Shared Access to your AWS Account
3. Granular Permissions Identity Federations (i.e. Active Directory, Facebook, LinkedIn, etc.)
4. Multifactor authentication (You should ALWAYS do this)
5. temporary access for users/devices and services when necessary
6. Custom Password rotation policy
7. Integration with many AWS services
8. Supports PCI DSS Compliance

Question 3

What are Users and Groups? What is the key relationship between them?

Answer 3

Users are End-Users (people, employees of an organization, etc.)

Groups are: Collections of Users

Each user in a Group inherits the permissions of the group

Question 4

What are IAM Policies

Answer 4

Policies are comprised of policy documents, which are JSON docs that give permissions to a USER, GROUP, or ROLE

Question 5

What is an IAM Role and What is its purpose in AWS?

Answer 5

Role: is a a custom “label” assigned to an AWS resource.

It allows one part of AWS to do something with another part

Question 6

How broad is the IAM NameSpace?

Answer 6

IAM has a Global NameSpace

Question 7

What permissions does an IAM user have when first created?

Answer 7

A NEW USER has NO-PERMISSIONS, when first created (think least privileges)

Question 8

At a very high level, what does AWS IAM do?

Answer 8

IAM allows you to manage users and their level of access to the AWS console

Question 9

What account is the ROOT ACCOUNT in IAM?

Answer 9

The ROOT ACCOUNT is the account created when you first setup your AWS account.

Question 10

What access does the ROOT ACCOUNT have?

Answer 10

The ROOT ACCOUNT has complete Admin Access (God Mode)

Question 11

What are Access Key ID and Secret Access Key used for?

Answer 11

Access key ID and Secrete Access Key are used for:
Programmatic access {AWS APIs & CLI)… think of it as it applies to User-Name/PassWord for programmatic access

Access Key ID & Secret Access Key can NOT be used to log into the console

Question 12

Can you Access Key ID and Secret Key be used to log into the AWS CLI/API?

Answer 12

YES

Question 13

Can your access KEY ID and Secret Access Key be used to log into the AWS Console?

Answer 13

NO

Question 14

How are you assigned an Access Key ID and Secret Access Key?

Answer 14

Access key ID and Secret Access Key are assigned to New-Users upon creation. These Keys can only be viewed ONCE at the the time of creation.

Question 15

IF you lose your AWS Access key ID and Secret Access Key how can you recover them?

Answer 15

You Can’t Recover AWS Access Key ID and Secret Access keys.

You will need to generate a new pair.