What is AWS IAM?
IAM (Identity and Access Management) is a global AWS service that controls who can access AWS resources and what actions they can perform.
Is IAM a regional or global service?
IAM is a global service.
What is an IAM identity?
An IAM identity is an entity that can be authenticated by AWS and granted permissions to access AWS resources.
What are the three IAM identities?
IAM User; IAM Role; Root User.
Is an IAM group an IAM identity?
No. IAM groups cannot authenticate and are not IAM identities.
Is a policy an IAM identity?
No. Policies only define permissions and cannot authenticate.
What is an IAM user?
An IAM user represents a person or application with long-term credentials and assigned permissions.
What credentials can an IAM user have?
Username and password for the AWS Console and access key and secret key for CLI or SDK.
How does an IAM user get permissions?
Through policies attached directly or policies inherited from groups.
What is an IAM role?
An IAM role is an identity that provides temporary credentials and must be assumed.
Does an IAM role have long-term credentials?
No. IAM roles only use temporary security credentials.
Who can assume an IAM role?
IAM users; AWS services like EC2 or Lambda; other AWS accounts; external identity providers.
What is the most common use of IAM roles?
Granting permissions to AWS services such as EC2 accessing S3.
What is the root user?
The root user is the original identity created with the AWS account and has unrestricted access.
Can IAM policies restrict the root user?
No. The root user cannot be restricted by IAM policies.
When should the root user be used?
Only for account-level tasks like closing the account or changing the support plan.
What is an IAM policy?
A JSON document that defines permissions using Effect
What are the three main types of IAM policies?
AWS managed policies; customer managed policies; inline policies.
What is an AWS managed policy?
A policy created and maintained by AWS and automatically updated.
What is a customer managed policy?
A custom policy created by the customer and reusable across multiple identities.
What is an inline policy?
A policy directly attached to a single identity and not reusable.
Are inline policies recommended?
No. Managed policies are preferred.
How are permissions granted in AWS?
Permissions are granted only through policies.
Are policies the only way to grant permissions in AWS?
Yes. All permissions in AWS are defined by policies.
