IAM 101 Flashcards
What is IAM (Identity Access Management)?
IAM allows you to manage users and their level of access to the AWS Console.
List the features of IAM
- Centralized control of your AWS account
- Shared Access to your AWS Account
- Granular Permissions (access to this but not that)
- Identity Federation
- Multi Factor Authentication
- Temporary access for users/devices and services where necessary ( such as when using a mobile app, access only when using the app)
- Allows you to set up your own password rotation policy
- Integrates with many AWS Services
- Supports PCI DSS Compliance
What is Identity Federation?
Allows users to potentially log into the AWS Console using the same credentials as Active Directory, Facebook, LinkedIn etc.
What is PCI DSS Compliance?
A framework you must be compliant with to be able to accept Credit Card information.
What are IAM Users?
End users such as people/employees of an organization.
What are IAM Groups?
A collection of users. Each user in the group will inherit the permissions of the group.
What are IAM Policies?
Policies are made up of documents called Policy Documents. These documents are in JSON and they give permissions as to what a User/Group/Role is able to do.
What are IAM Roles?
You create roles and then assign them to AWS Resources (users and/or services, grant a user or EC2 instance access to read/write to S3 bucket)
True or False: IAM applies to specific Regions
False: IAM is universal, it does not apply to regions at this time.
What is the IAM Root Account?
The Root Account is the account created when you first setup your AWS account. It has complete Admin Access.
True or False: New IAM users have NO permissions when first created
True; they must be assigned access, including to the Console and/or Command Line.
What is IAM Programmatic Access?
Programmatic Access allows a user to connect to AWS via API, and AWS CLI. This type of access requires an Access Key ID and Secret Access Key to login.
What is IAM Console Access?
Console Access allows a user to connect to AWS via the AWS web page interface. This requires a password, not Access Keys.
True or False: You can provide a user their Access Keys or Password if they forget them.
False: You can only view the Access Keys and Password once. This is during the initial creation of the user.
How can I allow an EC2 instance to write to an S3 bucket?
The EC2 instance will need an IAM Role assigned to it with the S3 Admin Access permission.
