IAM: identity and access management

Question 1

IAM

Answer 1

ID and access management - a global service

Question 2

root account

Answer 2

created by default - don’t share

Question 3

users

Answer 3

people within an org. can be grouped.

Question 4

groups

Answer 4

only contain users; users can belong to multiple groups

Question 5

IAM permissions

Answer 5

• users / groups can be assigned JSON docs called Policies
• policies define permissions of users
• least privilege principle: don’t give more permissions than users need

Question 6

IAM Policies Structure

Answer 6

• JSON
• version: policy language version / always include “2022-12-16”
• id: an identifier for the policy
• statement: one or more individual statements (required) + has:
  • sid (statement id)
  • effect (whether statement allows/denies access)
  • principal (account/user/role to which this policy applied to)
  • action (list of actions this policy allows/denies)
  • resource (list of resources which actions apply to)
  • condition (for when policy is in effect - optional)

Question 7

AWS Access 3 Options

Answer 7

AWS Management Console (generate Access Keys), AWS Command Line Interface (CLI), AWS Software Developer Kit (SDK)

Question 8

Access Keys

Answer 8

generated through AWS Management Console

• key ID: username
• secret access key: pw

Question 9

AWS CLI

Answer 9

• direct access to public API of AWS Services
• can develop scripts to manage resources
• open-source, alternate to Management Console (same permissions)

Question 10

AWS SDK

Answer 10

• language specific APIs (set of libraries)
• enables you to access + manage AWS services programmatically
• supports Js, Python, PHP, .NET, Ruby, Java, Go, Node.js, C++

Question 11

IAM Roles

Answer 11

common roles: EC2 Instance Roles, Lambda Function Roles, roles for CloudFormation

trusted entity type: AWS Services

Question 12

IAM Credentials Report (Account Level)

Answer 12

report that lists all your account’s users and status of credentials

Question 13

IAM Access Advisor (User Level)

Answer 13

shows service permissions granted to a user and when services were last accessed

can use this to revise your policies to the least privilege principle (i.e, if a user isn’t using a service, remove service access)

Question 14

Shared Responsibility Model

Answer 14

AWS: infrastructure (global network security), configuration + vulnerability analysis, compliance validation

Customer: users/groups/roles policy management, MFA across all accounts, rotate keys often, IAM permissions and access patterns