IAM (Identity and Access Management)

Question 1

Overview

Answer 1

least privilege principle

Question 2

Access Advisor

Answer 2

Need more details

Question 3

Cognito

Answer 3

Identity management
Let aws user add sign-in, signup to web and mobile apps quickly
Support OIDC, SAML 2.0

Question 4

Directory services

Answer 4

Managed Microsoft active directory

Question 5

Account alias

Answer 5

Customize login url

used as the account ID

Question 6

IAM Root user

Answer 6

created by default, should not share, has the most power

MFA should be enabled

Question 7

IAM Users

Answer 7

can be part of 0 to n groups

Question 8

IAM Identities

Answer 8

Users
Groups
Roles

Question 9

IAM Group

Answer 9

Contains users only

Question 10

IAM Policies

Answer 10

Types
Identity-based: attach managed and inline policies to IAM identities → grant permission to identities
Resource-based policies: attach inline policies to resources.
Permissions boundaries:
Define maximum permissions that the identity-based policies can grant to an entity
Does not grant specific permission
Do not define the maximum permissions that a resource-based policy can grant
Organizations SCPs:
Use with AWS Organizations
Define the maximum permissions for account members of and organization or organization unit
Do not grant a specific permission
Access Control Lists (ACLs)
The only policy that doesn’t use JSON structure
Similar to resource-based policies
Session policies
Used to manage access by creating policy and attach to IAM identities
Define permissions
When creating a new IAM Policy, these are the required fields:
PolicyName
PolicyDocument
AWS managed policies
Standalone policies created and managed by AWS
Provide permissions for common use cases
Customer managed policies
Standalone policies that are created and managed by the user
Inline policies
embedded in an IAM identity
Inline vs managed policy

Question 11

Roles

Answer 11

Not used by users but by programs

For example, assign a role to EC2 to do some tasks on aws

Question 12

Strong password using password policy

Answer 12

Require length
prevent-reuse
force rotation

Question 13

CloudShell

Answer 13

Terminal in the cloud (similar to google’s shell)

Terminal open in browser

Question 14

Role

Answer 14

Consists of permissions

Use to create custom combinations of permissions

Question 15

IAM Credentials report

Answer 15

Export all accounts to CSV highlighting which account has MFA enabled etc.