IAM 101

Question 1

What does IAM stand for?

Answer 1

Identity Access Management

Question 2

What are some of the features of IAM (9)

Answer 2

• Centralized control of your AWS account
• Shared Access to your AWS account
• Granular Permissions
• Identity Federation (i.e. Active Directory, Facebook, LinkedIn, etc.)
• Multifactor authentication (you should ALWAYS do this)
• Temporary access for users/devices and services when necessary
• Custom Password rotation policy
• Integration w/ many AWS services
• Supports PCI DSS compliance

Question 3

What are Users and Groups? What is the key relationship between them?

Answer 3

• Users are end users (people, employees of an organization, etc.)
• Groups are collections of users.
• Each user in the group inherits the permissions of the group.

Question 4

What are IAM Policies?

Answer 4

Policies are comprised of policy documents, which are JSON docs that give permissions to a user, group, or role.

Question 5

What is a Role?

Answer 5

• A Role is a custom “label” assigned to an AWS resource. - It allows one part of AWS to do something with another part.

Question 6

How broad is the IAM namespace?

Answer 6

IAM has a GLOBAL namespace

Question 7

Which account is the root account in IAM?

Answer 7

• The root account is the account created when you first setup your AWS account.

Question 8

What are Access Key ID and Secret Access Key? How are you assigned them? What can they be used for?

Answer 8

• Access Key ID and Secret Access Key are assigned to new users upon creation. - Access Key ID and Secret Access Key are used for *programmatic access* (AWS APIs and CLI)…think of it like the username/password for programmatic access - Access Key ID and Secret Access Key can NOT be used to log in to the console. - You can only view them ONCE. If you lose them, you have to regenerate them.

Question 9

What permissions does a user have when first created?

Answer 9

A New user has NO permissions when first created (think least privileges)

Question 10

How would I set up to be automatically notified if my account spending goes over a certain amount?

Answer 10

Create a billing alarm in CloudWatch

Question 11

At a very high level, what does IAM do?

Answer 11

IAM allows you to manage users and their level of access to the AWS console

Question 12

What access does the root account have?

Answer 12

The root account has complete admin access (god mode)