Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS SysOps > IAM, Accounts, and AWS Organizations > Flashcards

IAM, Accounts, and AWS Organizations Flashcards

(72 cards)

Start Studying
1
Q

IAM Policies

A

Grants or denies access to identities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Policy Document

A

Written in JSON to tell what is allowed or denied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

(T/F) An individual can have multiple IAM Policies

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

SEAR

A

Statement ID, Effect, Action, Resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

IAM Policy Document Statements

A

SEAR or SARE - Statement ID or SID (optional), ex. Full Access; Action can be very specific and then the service : and can be specific or * ex. Action: [“s3:&”]; Resource specifies the resources, can be specific or wildcard ex Resource: [“*”]; Effect is to either allow or deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

DAD

A

Priority of IAM Policy Statements - Deny, Allow, Deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Priority of IAM Policy Statements

A

First is explicit deny. If a resource is denied, it cannot be accessed.
Second is explicit allow. If a resource is allowed and there is no explicit deny, it is allowed.
Third is implicit deny. If there is not statement allowing a service, it is denied implicitly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Two types of IAM Policies

A

Inline and Managed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Inline Policy

A

applying JSON to each account individually. Not best practice. Got to make changes to each individual JSON policy. Usually used for special or exceptional allow or deny.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Managed Policy

A

created as its own object and attach it to any policy that wants to gain those access rights. They are RESUABLE and LOW MANAGEMENT OVERHEAD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Two types of Managed Policies

A

AWS Managed Policies and Custom Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IAM Users

A

an identity used for anything requiring LONG-TERM AWS access e.g. HUMANS, APPLICATIONS or SERVICE ACCOUNTS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Authenticated Identity

A

U&P and Access Keys (services); proves identity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Authorization

A

IAM checking the authentication and allowing or denying access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Exam Alert: (T/F) Internet scale apps and large organizations with more than 5,000 users should use IAM Users.

A

False. 5,000 IAM users PER ACCOUNT; IAM User can be a member of 10 GROUPS; This has design impacts – remember the limits for the exam which may discuss large organizations or Internet scale apps that have more than 5,000 users then IAM will not be the right choice.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

IAM Groups

A

containers for USERS; solely for organizing users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

(T/F) You can log into a group

A

False. You CANNOT log into a group – no credentials, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

(T/F) An IAM user can only be a member of one IAM Group.

A

False. An IAM user can be a member of multiple IAM Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

IAM Group Policies

A

Two kinds of Group Policies both Inline or Managed and have permissions from each group plus whatever permissions for the user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

(T/F) There isn’t a built in all users group in IAM

A

True. There isn’t a built in all users group in IAM – you can create one but it isn’t native.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

(T/F) There is no nesting in groups

A

True. You can not nest one group inside another group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Total groups per account

A

300 Groups per accounts but can be increased with support tickets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Reference Policy

A

controls access to a specific resource and allows or denies identities to that resource; reference through ARN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

(T/’F) Groups are a true identity of a user

A

False. Groups are NOT a TRUE IDENTITY. They can’t be referenced as a PRINCIPAL in a resource policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
IAM Roles
exists in AWS account. Best suited for an unknown number or multiple principals. Can be internal or external.
26
(T/F) IAM roles are ASSUMED. YOU BECOME that role.
IAM roles are ASSUMED. YOU BECOME that role. Generally short term. Think about a mobile app that gains access through a role and become an identity in an AWS account for a short period of time.
27
Two types of policies attached to IAM Roles
Trust policy and permissions policy
28
Trust Policies
says what identities can access that role – reference identities in the same account or services and can reference other identities in other AWS accounts, even anonymous, or SSO via Google, Facebook, etc.
29
Permissions Policy
says what can be accessed.
30
(T/F) Roles cannot be accessed with Resource Policies
False
31
STS
Secure Toke Service – sts:AssumeRole – know that roles are involved. Works with Temporary Security Credentials
32
When to use IAM Roles
All through Permissions Policy; - AWS Lambda functions known as a Lambda Execution Role so you don’t need to hardcode permission (access keys); - out of the usual situations (emergencies) think third-party help desk; adding AWS into an on-prem environment – EXISTING IDENTITIES through SSO or go above the 5000 user limit; - application with 1,000,000 of users that may need to access DynamoDB (ride sharing app) – Web identity Federation; cross AWS account
33
Web identity Federation
uses IAM roles to access certain services and allows for SSO through Google, Facebook, etc. – NO AWS CREDENTIALS on the APP, uses EXISTING customer LOGINS, scales to 1,000,000,000’s of accounts and beyond
34
ID Federation
small number of roles to manage and/or external
35
(T/F) External accounts can be used in AWS directly
False
36
Break Glass Situations
emergency situations
37
Function Invocation or Execution
running a Lambda function
38
Service Linked role
IAM role linked to a SPECIFIC AWS SERVICE; PREDEFINED by a SERVICE; providing permissions that a SERVICE needs to interact with OTHER AWS SERVICES on your behalf; SERVICE might create/delete the role or allow YOU to during the SETUP or within IAM
39
(T/F) You can’t delete the service linked role until it’s no longer required
True
40
Under Resource in the JSON
don’t try and guess the service-name of the resource, the FORMAT can differ and is CASE sensitive
41
PassRole
gives the ability to implement role separation.
42
AWS Organizations
Consolidated billing and identities of all accounts.
43
Hierarchy Structure of AWS Accounts
take a standard AWS account and create an organization – this is MANAGEMENT (master) account – and invite other accounts into the organization and then those invited accounts are member accounts of the organization. Hierarchical. Consolidated Billing (single bill) to the payment account aka Management account. Consolidation of RESERVATIONS and VOLUME DISCOUNTS.
44
Organization Root
Top of the Organization hierarchy. Container within an AWS organization that contain AWS accounts. Also contain other containers aka organization units or OUs. Organization root at the top and OUs underneath hierarchically.
45
Standard AWS Account
An account not within an organization
46
Service Control Policy (SCP)
restrict what AWS accounts can do in the AWS organization.
47
(T/F) Creating a new account within AWS organizations requires no invite process.
True
48
(T/F) Organizations need IAM users in each account
False. Organizations don’t need IAM users in each account as IAM roles can be used to access other AWS accounts.
49
Role Switch
federation on-prem identities switch into other accounts in the organization and assuming the role.
50
Exam question, the overlap between identity policies and SCP
If not allowed in IAM but allowed in SCP then won’t be allowed. If allowed in IAM but denied in SCP then not allowed. If allowed in IAM and allowed in SCP then allowed.
51
Service Control Policy (SCP)
ACCOUNT PERMISSIONS BOUNDARIES AND LIMIT WHAT ACCOUNT CAN DO including ROOT USER in ORGANIZATIONS. DON’T GRANT PERMISSIONS – THEY LIMIT PERMISSIONS. ALLOW or DENY list. Follows DAD. You can’t restrict the root user, it will allows have full control of the account but SCP can restrict the account thereby restricting the root user.
52
CloudWatch Logs
PUBLIC SERVICE; STORE, MONITOR, and ACCESS logging data; AWS INTEGRATIONS – EC2, Lambda, CloudTrail, and more; if no integration, need CLOUDWATCH AGENT; METRIC FILTER (create metrics from the logs)
53
Log Stream
sequence of log events from the same source
54
Log Group
container for log streams; define retention and permissions and applies to all streams in the container; metric filters resides here as well
55
CloudTrail
REGIONAL service. Logs API calls/activities as a CLOUDTRAIL EVENT. Stores 90 days by default in EVENT HISTORY; enabled BY DEFAULT at no cost.
56
Trail (CloudTrail)
To customize you need to create a TRAIIL. A trail can be configured for one region or all regions and can be stored in an S3 bucket indefinitely, you only pay for the space in the S3 bucket. CloudTrail can be integrated into CloudWatch logs with trails.
57
(T/F) Logs in the region that they occurred in or log to US East 1 for global such as IAM STS CloudFront.
True
58
Two types CloudTrail Events
MANAGEMENT (default) events and DATA (configured and $$) events.
59
Exam alert, is CloudTrail in real time?
CloudTrail is NOT REAL-TIME, there is a delay (within 15 minutes generally).
60
Service Catalog
DOCUMENT or DATABASE created by an IT team (service documentation); organized COLLECTION of PRODUCTS; KEY PRODUCT INFORMAIONT: owner, cost, requirements, support info, dependencies; defines approval of provisioning from IT and customer.
61
AWS Service Catalog
SELF-SERVICE portal for end users; launch PREDEFINED PRODUCTS (ADMINS SET UP). Think of it like this, sales team needs to launch an EC2 instance but IT doesn’t want to give them the infrastructure capabilities with an AWS account so they set up AWS Service Catalog with CloudFormation and they can launch the instance that way. Build PRODUCTS into PORTFOLIOS.
62
Admin role in Service Catalog
DEFINED PRODUCTS and PORTFOLIOS using CLOUDFORMATION TEMPLATES and SERVICE CATALOG CONFIGURATION then deploy PORTFOLIO to any service enabled regions. Service catalog users review PORTFOLIOS they have permissions on and LAUNCH PRODUCTS into service enabled regions. Service catalog, launches the infrastructure using DEFINED TEMPLATES. Service catalog users don’t need infrastructure permissions.
63
Exam alert, see any question talk about a need for users or customers to release services with a tight infrastructure, think
Service Catalog
64
Any exam questions about exploring cost or evaluate cost, also can give recommendations about reserved instance purchases
CostExplorer
65
Cost anomaly shows in
CostExplorer
66
SAML
Security Assertion Markup Language – Open Standard used by idP e.g. MS ADFS. INDIRECTLY use on premises ID w/ AWS. Used when using an ENTERPRISE identity provider (not Google SSO for example). EXISTING identity management team. SINGLE SOURCE OF TRUTH MORE THAN 5000 users. Uses IAM ROLES and TEMP CREDENTIALS (12 hour window).
67
(T/F) SAML cannot use enterprise credentials directly, they have to be exchanged for AWS credentials.
True
68
SSO
Manage SSO Access – AWS ACCOUNTS and EXTERNAL APPLICATIONS. Flexible IDENTITY SOURCE system. There is a built-in identity store, AWS Managed AD, On-premises AD by TWO WAY TRUST or AD CONNECTORS, or SAML 2.0.
69
(T/F) SSO is not preferred by AWS vs traditional workforce identity federation.
False
70
Two phases of SSO
1.) Single Sign on; 2.) Provides centralized permissions management across accounts.
71
Exam Alert: If it is web identities such as Facebook, Twitter, Google, it won’t use SSO.
If it is enterprise identities, it will be SSO.
72

AWS SysOps (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions