IAM

Question 1

What is an AWS Role?

Answer 1

• A role is an identity you create that has specific permissions on AWS resources.
• It is assumable by entities that need it.
• Roles are temporary.

Question 2

Who can assume a role?

Answer 2

• Users
• AWS Architecture (EC2s)
• System level accounts

Question 3

What do you attach to a group to assign priviliges to that group?

Answer 3

A policy.

Question 4

How are Roles and Users similar in IAM? How are they different?

Answer 4

Both are assigned policies to grant access to resources but where Roles are temporary and assumable, Users are permanent.

Question 5

What is AWS STS

Answer 5

Security Token Service - Allows for creation of temporary users and access privileges

Question 6

When you create a policy.. what can you assign it to?

Answer 6

• Users (hard to maintain)
• Groups

Question 7

Does it make sense to attach a Policy to an EC2 instance?

Answer 7

NO!!!! You attach policies to Roles, and attach Roles to Instances

Question 8

What are these in IAM? What is an example of each?

• User
• Group
• Role

Answer 8

• A user is an individual who can log into AWS console or use the CLI using access keys. A User CAN be assigned access policies, though this is not the best practice.
• A group is a collection of users with common access needs in AWS. You should add access policies to a group, then assign users to a group
• A role is similar to a user, but a role can never log in. It is an identity assumable by anyone or anything that needs it, and it grants temporary AWS access.

Question 9

What do each of these managed IAM policies grant?

• AdministratorAccess
• PowerUserAccess
• SystemAdministratorAccess

Answer 9

• AdministratorAccess - Grants full access to everything in AWS
• PowerUserAccess - Developer access for application development and partial Organisation access. Grants everything but IAM access
• SystemAdministratorAccess - No Organization level access

Question 10

How can you create and grant temporary token-based access to AWS resources?

Answer 10

AWS STS (Stimple Token Service)