IAM and AWS CLI

Question 1

Can groups contain other groups?

Answer 1

No

Question 2

What are policies?

Answer 2

JSON documents that define permissions of users

Question 3

What is an account alias?

Answer 3

Allows for custom sign in URL for user

Question 4

What are tags?

Answer 4

Optional key value pairs that you can add to AWS resources to help identify/organise/search for resources (eg. Key = Department, Value = Engineering)

Question 5

What is an inline policy?

Answer 5

Policy that is only attached to a user

Question 6

AWS password policies

Answer 6

Can setup policy for setting min password length, specific character types, allowing IAM users to change their own passwords, password expiration, preventing password reuse, MFA

Question 7

AWS MFA options

Answer 7

Virtual MFA device (eg. google authenticator) or U2F security key (eg. YubiKey) or Hardware Key Fob or Hardware key Fob MFA for AWS GovCloud (USA)

Question 8

3 ways to access AWS

Answer 8

• AWS Management Console (protected by password)
• AWS CLI (protected by access keys)
• AWS SDK (protected by access keys)

Question 9

What does aws configure do?

Answer 9

Allows your to configure your AWS CLI (eg. add access keys, region)

Question 10

What are IAM roles?

Answer 10

Used to assign permissions to AWS services with IAM roles (eg. create IAM role for EC2 instance), gives AWS services permission to do stuff on AWS

Question 10

What is AWS cloudshell?

Answer 10

Terminal in cloud of AWS online, can download files from it (only available in some regions)

Question 11

IAM security tools

Answer 11

• IAM Credentials Report (account-level) - lists all your account’s users and the status of their various credentials
• IAM Access Advisor/LastAccess (user-level) - Shows service permissions granted to a user and when those services were last accessed

Question 12

IAM best practices

Answer 12

• Dont use root account except for AWS account setup
• One physical user = one AWS user
• Assign users to groups and assign permissions to groups
• Strong password policy
• Use and enforce MFA
• Create and use roles for giving permissions to AWS services
• Use access keys for CLI / SDK
• Audit permissions using IAM Credentials Report and AccessAdvisor/LastAccess