Sec. 4: IAM & AWS CLI

What is a proper definition of an IAM Role?

• IAM Users in multiple User Groups

• An IAM entity that defines a set of permissions for making requests to AWS services, and will be used by an AWS service

• An IAM entity that defines a password policy for IAM Users

• Permissions assigned to IAM Users to perform actions

Answer explanation

Some AWS services need to perform actions on your behalf. To do so, you assign permissions to AWS services with IAM Roles.

Which of the following is an IAM Security Tool?

• IAM Credentials Report

• IAM Root Account Manager

• IAM Services Report

• IAM Security Advisor

Answer explanation

IAM Credentials report lists all your AWS Account's IAM Users and the status of their various credentials.

Which answer is INCORRECT regarding IAM Users?

• IAM Users can belong to multiple User Groups

• IAM Users don't have to belong to a User Group

• IAM Policies can be attached directly to IAM Users

• IAM Users access AWS services using root account credentials

Answer explanation

IAM Users access AWS services using their own credentials (username & password or Access Keys).

Which of the following is an IAM best practice?

• Create several IAM Users for one physical person

• Share your AWS account credentials with your colleague, so he can perform a task for you

• Don't use the root user account

• Do not enable MFA for easier access

Answer explanation

Do not enable MFA for easier access

What are IAM Policies?

• A set of policies defines how AWS accounts interact with each other

• JSON documents that define a set of permissions for making requests to AWS services, and can be used by IAM Users, User Groups, and IAM Roles

• A set of policies that define a password for IAM Users

• A set of policies defined by AWS that show how customers interact with AWS

Which principle should you apply regarding IAM Permissions?

• Grant least privilege

• Grant most privilege

• Grant more permissions if your employee asks you to

• Restrict root account permissions

Answer explanation

That's right! Don't give more permissions than the user needs.

What should you do to increase your root account security?

• Remove permissions from the root account

• Only access AWS services through AWS Command Line Interface (CLI)

• Enable Multi-Factor Authentication (MFA)

• Don't create IAM Users, only access your AWS account using the root account

Answer explanation

When you enable MFA, this adds another layer of security. Even if your password is stolen, lost, or hacked your account is not compromised.

IAM User Groups can contain IAM Users and other User Groups.

• True

• False

Answer explanation

IAM User Groups can contain only IAM Users.

An IAM policy consists of one or more statements. A statement in an IAM Policy consists of the following, EXCEPT:

• Effect

• Principal

• Version

• Action

• Resource

Answer explanation

A statement in an IAM Policy consists of Sid, Effect, Principal, Action, Resource, and Condition. Version is part of the IAM Policy itself, not the statement.

According to the AWS Shared Responsibility Model, which of the following is AWS responsibility?

• Rotate Access Key for IAM Users

• Enable MFA for the root account and all IAM Users

• IAM Users, User Groups, and IAM Policies

• AWS Infrastructure