Chapter 10 - Advanced IAM

Which allows users to use their social media account to gain temporary access to the AWS platform?

• Active Directory Authentication Services

• Facebook Sign-In Service

• Web Confederation Services

• Web Identity Federation

Answer explanation

Correct. Web identity federation removes the need for creating individual IAM users. Instead, users can sign in to an identity provider and then obtain temporary security credentials from AWS Security Token Service (AWS STS).

Which statement best describes IAM?

• IAM allows you to manage users, groups, and roles and their corresponding level of access to the AWS Platform.

• IAM stands for Improvised Application Management, and it allows you to deploy and manage applications in the AWS Cloud.

• IAM allows you to manage users' passwords only. AWS staff must create new users for your organization. This is done by raising a ticket.

• IAM allows you to manage permissions for AWS resources only.

Answer explanation

Correct. Using IAM, you can create and manage AWS users, groups, roles, and use permissions to allow and deny their access to AWS resources.

Which of the following applies to an AWS Managed Policy?

Choose 3

• It can only be assigned to a single user, group or role in your account

• It is available for use by any AWS account

• You can change the default permissions defined in the policy

• AWS occasionally updates the permissions defined in an AWS managed policy

• It can be assigned to multiple users, groups or roles

Answer explanation

Correct. AWS managed policies are designed to provide permissions for many common use cases. They are available and can be used in any AWS account.

Correct. AWS occasionally updates the permissions defined in an AWS managed policy. When AWS does this, the update affects all principal entities (users, groups, and roles) that the policy is attached to.

Correct. You can attach AWS managed policies to multiple principal entities in your AWS account.

Which of the following API calls can be used to enable a user authenticated by Facebook to access your web application hosted in AWS?

• STS assume-role-with-web-identity

• STS get-federation-token

• STS assume-role-with-saml

• STS assume-role

Answer explanation

Correct. assume-role-with-web-identity returns a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider. Example providers include Amazon Cognito, Login with Amazon, Facebook, Google, or any OpenID Connect-compatible identity provider.

You are developing a new mobile application to share photos, which AWS technology can you use to ensure your users have a seamless experience across all their devices?

• IAM

• Multi-Factor Authentication

• Cognito

• Web Identity Federation

Answer explanation

Correct. AWS recommends Amazon Cognito to synchronize user data seamlessly across end users’ devices. Reference: Using Amazon Cognito to Sync Data (https://aws.amazon.com/blogs/mobile/using-amazon-cognito-to-sync-data/).

When would you use an Inline Policy over a Managed Policy?

• When you want to change policies that are attached to multiple principal entities.

• To add IAM permissions for common use cases like giving your DBAs full access to DynamoDB

• To add permissions that are only ever intended to be used for a single user in your account

• To add IAM permissions that can be applied to multiple AWS accounts that you own

Answer explanation

Correct. Inline policies are useful if you want to maintain a strict one-to-one relationship between a policy and the identity that it's applied to. For example, you want to be sure that the permissions in a policy are not inadvertently assigned to an identity other than the one they're intended for.

Which of the following features of IAM allows you to have your users Authenticate using Facebook, Google or Amazon?

• The IAM HTTPS API

• AWS Single Sign-On (SSO)

• Multi-Factor Authentication

• Web Identity Federation

Answer explanation

Correct. With web identity federation, you don't need to create custom sign-in code or manage your own user identities. Instead, users of your app can sign in using a well-known external identity provider (IdP), such as Login with Amazon, Facebook, Google, or any other OpenID Connect (OIDC)-compatible IdP.

When using Web Identity Federation to allow a user to access an AWS service (such as an S3 bucket), which of the following is the correct order of steps?

• A user logs in to the AWS platform using their Facebook credentials. AWS authenticate with Facebook to check the credentials. Temporary Security Access is granted to AWS.

• Users cannot use Facebook credentials to access the AWS platform.

• A user authenticates with Facebook first. They are then given an ID token by Facebook, which they can then trade for temporary security credentials.

• A user makes the AssumeRoleWithWebIdentity API Call. The user is then redirected to Facebook to authenticate. Once authenticated, the user is given an ID token. The user is then granted temporary access to the AWS platform.

Answer explanation

Correct. The user needs to authenticate with Facebook first, that will return a web identity token. Then AWS STS is called and passes the web identity token as input. AWS STS authorizes the call and provides temporary AWS access credentials. The user is allowed to assume an IAM role and access AWS resources in accordance with the role's security policy.

Which of the following correctly describes an Inline Policy?

Choose 2

• It can be attached to multiple users and groups within your AWS account

  
  

• You cannot change the permissions defined in the policy

• The policy will be deleted if you delete the user, group or role it is associated with

• It is embedded in a user, group or role

Answer explanation

Correct. When you use the AWS Management Console to delete an identity, the inline policies embedded in the identity are deleted as well. That's because they are part of the principal entity.

Correct. An inline policy is a policy that's embedded in an IAM identity (a user, group, or role).

What does Cognito use to manage sign-up and sign-in functionality for mobile and web applications?

• IAM Groups

• Identity Pools

• User Pools

• IAM Users

Answer explanation

Correct. A user pool is a user directory in Amazon Cognito. With a user pool, your users can sign-up and sign-in to your web or mobile app through Amazon Cognito.