2 AWS Identity and Access Management Free Online FlashCards

What are authentication and authorization in IAM?

Authentication verifies an identity; authorization determines whether a request is permitted.

What is an IAM user, and when does AWS recommend using one?

IAM users are identities in one AWS account with credentials and permissions. AWS recommends them only when federation and temporary credentials are unsuitable.

What can an IAM group do, and what can it not do?

IAM groups collect users so shared permissions can be managed together. Groups are not principals and cannot be assumed as roles.

What defines an IAM role?

An IAM role is an identity with permissions that a trusted principal can assume. It supports temporary access for people, workloads, services, or cross-account users.

How do federated identities access AWS?

Federated identities are managed by an external identity provider and access AWS by obtaining temporary credentials through a role.

What does an IAM policy describe?

A policy is a JSON document that describes permissions, including which actions and resources are covered and, optionally, the conditions that apply.

How do identity-based and resource-based policies differ?

Identity-based policies attach to users, groups, or roles. Resource-based policies attach to supported resources, such as an S3 bucket.

What do Effect, Action, Resource, and Condition specify in a policy statement?

Effect specifies Allow or Deny; Action identifies covered API operations; Resource identifies covered resources; Condition optionally sets circumstances for the statement to apply.

What is IAM's default decision, and what overrides an Allow?

AWS denies requests by default unless an applicable policy allows them. An explicit Deny overrides an Allow.

What does a permissions boundary do?

A permissions boundary sets the maximum permissions an identity-based policy can grant. It does not grant permissions by itself.

How do a role's trust policy and permissions policies differ?

A role's trust policy specifies which principals may assume it and under what conditions. Its permissions policies specify what an assumed session can do.

What two checks must succeed for a principal to use a role?

Both trust and permissions must be configured: the principal must be trusted to assume the role, and the resulting session must be allowed to perform the requested action.