IAM Section

Question 1

IAM

Answer 1

• Identity and Access Management, Global service
• Root account created by default, shouldn’t be used or shared
• Users are people within your organization, and can be grouped
• Groups only contain users, not other groups
• Users don’t have to belong to a group, and user can belong to multiple groups

Question 2

IAM Policy Structure

Answer 2

Consists of
• Version: policy language version, always include “2012-10-17”
• Id: an identifier for the policy (optional)
• Statement: one or more individual statements (required)

Statements consists of
• Sid: an identifier for the statement (optional)
• Effect: whether the statement allows or denies access (Allow, Deny)
• Principal: account/user/role to which this policy applied to
• Action: list of actions this policy allows or denies
• Resource: list of resources to which the actions applied to
• Condition: conditions for when this policy is in effect
(optional)

Question 3

MFA

Answer 3

password you know + security device you own

Question 4

MFA devices options in AWS

Answer 4

• Virtual MFA device
• Universal 2nd Factor (U2F) Security Key
• Hardware Key Fob MFA Device
• Hardware Key Fob MFA Device for AWS GovCloud (US)

Question 5

How can users access AWS

Answer 5

• AWS Management Console (protected by password + MFA)
• AWS Command Line Interface (CLI): protected by access keys
• AWS Software Developer Kit (SDK) - for code: protected by access keys

Question 6

AWS CLI

Answer 6

• A tool that enables you to interact with AWS services using commands in
your command-line shell
• Direct access to the public APIs of AWS services
• You can develop scripts to manage your resources
• It’s open-source https://github.com/aws/aws-cli
• Alternative to using AWS Management Console

Question 7

AWS SDK

Answer 7

• AWS Software Development Kit (AWS SDK)
• Language-specific APIs (set of libraries)
• Enables you to access and manage AWS services programmatically
• Embedded within your application

Question 8

IAM Roles

Answer 8

• assign permissions to AWS services with IAM Roles

Common roles:
• EC2 Instance Roles
• Lambda Function Roles
• Roles for CloudFormation

Question 9

IAM Credentials Report (account-level)

Answer 9

a report that lists all your account’s users and the status of their various
credentials

Question 10

IAM Access Advisor (user-level)

Answer 10

• Access advisor shows the service permissions granted to a user and when those
services were last accessed.
• You can use this information to revise your policies.