Section4: IAM & AWS CLI

Question 1

What is IAM?

Answer 1

• IAM = Identity and Access Management, Global service
• Root account is the default account.
• Users are people in your organization/company.
• Groups only contain users and not other groups.
• Users dont have to belong to a group and users can be in multiple groups.

Question 2

IAM: Permissions

Answer 2

• Users or Groups are assigned a JSON document called policies.
• Policies define the permissions of the users
• In AWS you apply the least privileges principle(dont give more permissions than a user needs)

Question 3

IAM Policies Structure

Answer 3

Consist of:

  - Version: Example "2012-10-17"
  - Id:  Example "S3-Account-Permissions"
  - Statement

Statment consist of:

 - SID: The id of the statement. Example: "1"
 - Effect: Exmaple "Allow"
 - Principal: sccount/user/role to which the policy applies Example "arn:aws:iam::12324354:root
 - Action: list of actions this policy allows or denies
 - Resource: list of resources to which the actions applied to Example "myBucket(Storage)"
 - Condition: conditions for when the policy is in effect

Question 4

What is IAM MFA?

Answer 4

• MFA = Multi Factor Authentication(Password + security device)

Question 5

What MFA devices do you get?

Answer 5

• Virtual MFA device Exampe Google Authenticator
• Universal 2nd Factor(U2F) Security Key. Its a physical device.
• Hardware Key Fob MFA Device. Also physical device
• Hardware Key Fob MFA Device for AWS GovCloud. Also physical device

Question 6

What are the 3 ways to access AWS?

Answer 6

• AWS Management Console
• AWS Command line interface(CLI)
• AWS Software Developer Kit(SDK)

Question 7

How to get access using the AWS CLI?

Answer 7

1) Create access keys for user
2) In cmd, type “aws configure”.
3) Enter your “Access Key ID”
4) Enter “Secret Access Key”
5) Enter default region name”
6) Enter “output format”, just press enter

Question 8

What is AWS Cloud Shell?

Answer 8

• it is like AWS CLI but build into the AWS console.

- It is only available for certain regions.

Question 9

What is a IAM Role?

Answer 9

• Giving access the services to perform a particular task.

Question 10

What IAM Security Tools do you get?

Answer 10

1) IAM Credentials report(account level)
- a report that list all account’s users and the status of their credentials
2) IAM Access Advisor(user-level)
- shows service permissions granted to a user and when last was it accessed

Question 11

IAM Guidelines & Best Practices

Answer 11

• Dont use the root account except for account setup
• One physical user = One AWS user
• Assign users to group and assign permissions to groups
• Create a strong password policy
• Use and enforce the use of Multi Factor Authentication(MFA)
• Create and use Roles for giving permissions to AWS services
• Use Access Keys for Programmatic Access(CLI/SDK)
• Audit permissions of your account with the IAM Credentials Report.
• Never share IAM users & Access Keys