IAM

Question 1

What kind of service is IAM?

Answer 1

Identity and access management (IAM) is a global service.

Question 2

What is IAM used for?

Answer 2

Creating users within an account and allocating permissions to these users to access aws account and resources.

Question 3

How are users organised?

Answer 3

you can create groups and add users into these groups. A single user can belong to multiple groups.

Question 4

What is an IAM policy?

Answer 4

An IAM policy is a JSON document that defines permission for a user.

Question 5

What is the least privilege principle?

Answer 5

It’s applied to IAM policy to provide only the needed permissions to the user and not more.

Question 6

How are policies applied to users?

Answer 6

IAM Policies are can be applied to individual users and to groups. Users that don’t belong to any group will have inline policies.
Users belonging to multiple groups will inherit policies from those groups.

Question 7

what are the main components of an IAM policy?

Answer 7

The policy consists of:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "elasticloadbalancing:Describe*"
,
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:ListMetrics",
"cloudwatch:GetMetricStatistics",
"cloudwatch:Describe*"
],
"Resource": "*"
}
]

Question 8

What is MFA?

Answer 8

Multi-Factor Authentication: used for securing your account, especially your root account.
This is a combination of a password you know and a security device you own.

Question 9

What are IAM Roles

Answer 9

IAM Roles are like users with permissions, Roles are for aws services that allow them to communicate or perform actions on other services.

Question 10

What are the IAM security tools

Answer 10

IAM Credentials Report (account-level)
• a report that lists all your account’s users and the status of
their various credentials
IAM Access Advisor (user-level)
• Access advisor shows the service permissions granted to a user and when the services were last accessed.
• You can use this information to revise your policies