2 Users, Groups, and Roles Free Online FlashCards

What is an IAM user?

An IAM user is an identity in one AWS account with its own credentials and permissions. New users have no permissions by default.

What should you prefer over long-term IAM user credentials for people?

For human access, AWS recommends federation and temporary credentials where possible. Use an IAM user when a specific requirement cannot be met with federation or a role.

Does a console-only IAM user need access keys?

No. A console-only user does not need access keys; create only the credentials that user needs.

How does an IAM group provide shared permissions?

An IAM user group is a collection of IAM users. Policies attached to the group provide its members with common permissions.

What can an IAM group contain, and can a user join multiple groups?

A user can belong to multiple groups, but a group cannot contain other groups, roles, or non-user identities.

Can an IAM group sign in or assume a role?

No. Groups organize user permissions; they are not identities that sign in or assume roles.

What happens when a trusted entity assumes an IAM role?

An IAM role has permissions but is not tied to one person and has no standard long-term password or access keys. A trusted entity assumes it to receive temporary session credentials.

What does each of an IAM role’s two policies control?

The trust policy specifies who or what may assume the role; the permissions policy specifies what the role session may do.

How should an AWS application get access to another AWS service?

Use a role trusted by the service and grant only the required resource access. Do not embed long-term IAM user keys in the application.

How should a contractor in another AWS account receive temporary access?

Use a role with a narrowly defined trust policy and permissions policy, and verify the cross-account trust configuration.

Several analysts need the same read-only access. What is an appropriate IAM approach?

Use an IAM group with the appropriate least-privilege permissions and add the analyst as a user. For human access, federation may be used instead.

What IAM access should be reviewed when a user changes jobs?

Remove the user from groups no longer needed, add them to the appropriate groups, and review direct permissions and role access.