IAM enables you to manage access to AWS services and resources securely. Key IAM features include password policies, multi-factor authentication (MFA), roles, SAML, federated identity, resource policies, and policy conditions. We’ll discuss each of these, highlighting their importance in the AWS Certified SysOps Administrator -Associate (SOA-C02) exam.
I. Password Policies
A password policy in AWS is a set of rules that define the type of password an IAM user can set. This includes settings like minimum length, whether it requires non-alphanumeric characters, or whether it can be reused. For example, to implement a password policy that consumers must have a password with at least 16 characters, the password must include upper case, and non-alphanumeric characters are implemented as below:
aws iam update-account-password-policy –minimum-password-length 16 –require-uppercase-characters –require-numbers –require-symbols
II. Multi-factor Authentication (MFA)
MFA enhances security by requiring users to provide multiple methods of identification. The most common example in AWS is using a username/password combined with a unique code (“token”) from an AWS MFA device. You can enable MFA on the IAM dashboard. Practically, you can set MFA using the `aws iam enable-mfa-device command`.
III. Roles
IAM roles are similar to users but have no associated credentials (password or access keys). Instead, trusted entities (like users, applications, or AWS services) assume roles to obtain temporary security credentials that can be used to make AWS API requests. Roles can be assigned using the AWS Management Console, AWS CLI, or AWS API.
IV. Security Assertion Markup Language (SAML)
SAML is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP). AWS supports identity federation with SAML 2.0, enabling Single Sign-On (SSO), allowing users to log in to the AWS Management Console.
V. Federated Identity
Federated identity refers to the standards, agreements, and technologies that enable a user to use the same digital identity to access various applications, systems, and networks. As AWS supports identity federation, a single user can sign-on to different accounts or applications within the AWS environment.
VI. Resource Policies
Resource-based policies are JSON policy documents that you attach to a resource to define what actions a specified principal can perform on that resource. For instance, you can attach a policy that grants a specific IAM user or AWS account permissions to access a bucket in Amazon S3.
VII. Policy Conditions
IAM policies can include conditions, named condition keys, to specify more detailed criteria for when to allow or deny access. Condition keys can include date, IP address, encryption status, or whether MFA is used.
AWS IAM is a comprehensive service to control user and programmatic access to resources. Understanding concepts like MFA, roles, federated identity, password policies, and SAML are crucial to operational AWS security and a key requirement for the SOA-C02 certification exam.
Practice Test
True/False: IAM roles are considered as a secure way to grant permissions to entities that you trust.
• True
• False
Answer: True
Explanation: IAM roles are a secure way to grant permissions that allow trusted entities to access resources and services without having to share long-term credentials or access keys.
Single-select: Which of the following is not a feature offered by AWS IAM?
• a) Password Policies
• b) Multi-factor Authentication (MFA)
• c) Role-based Access Control (RBAC)
• d) Serverless Authentication
Answer: d) Serverless Authentication
Explanation: AWS IAM offers features like Password Policies, Multi-factor Authentication (MFA), and Role-based Access Control (RBAC). However, Serverless Authentication is not a feature of AWS IAM.
Multi-select: Identify the correct statements about IAM features:
• i) IAM is region-specific
• ii) IAM allows sharing of security credentials between services
• iii) IAM supports identity federation
• iv) IAM does not support multi-factor authentication
Answer: ii) IAM allows sharing of security credentials between services and iii) IAM supports identity federation
Explanation: IAM is global and not region-specific. It allows the sharing of security credentials between services and supports identity federation. IAM also supports multi-factor authentication.
True/False: With federated identity, one can grant permissions to authenticated users from required organizations, regardless of their AWS account.
• True
• False
Answer: True
Explanation: Federated identity allows for identity management, thereby enabling the granting of permissions to authenticated users from required organizations, even if they do not have an AWS account.
Single-select: Which of the following is used for specifying what actions are allowed or denied?
• a) Roles
• b) Password policies
• c) Policies
• d) Multi-factor authentication
Answer: c) Policies
Explanation: Policies in AWS are used to specify what actions are allowed or denied in your resources.
Multi-select: As part of IAM password policy, which among the following can be enforced?
• i) Requiring at least one uppercase letter from the Latin alphabet
• ii) Setting password expiry period
• iii) Restricting password reuse
• iv) Restricting account access based on IP address.
Answer: i) Requiring at least one uppercase letter from the Latin alphabet, ii) Setting password expiry period, iii) Restricting password reuse
Explanation: Setting password expiry period, requiring a specific character type, and restricting password reuse are part of IAM password policy. Restricting account access based on IP address is part of IAM policy conditions but not part of password policies.
True/False: Only managed policies can be attached to multiple entities such as users, groups, and roles.
• True
• False
Answer: False
Explanation: Both managed policies and inline policies can be attached to multiple entities. The key difference is that managed policies are standalone entities that can be attached to multiple users, groups, and roles, whereas inline policies are embedded directly into a single entity.
Single-select: Where are IAM roles stored?
• a) EC2 Instances
• b) S3 Buckets
• c) IAM Service
• d) Lambda Functions
Answer: c) IAM Service
Explanation: IAM roles are entities in the IAM service. They are not stored in EC2 instances, S3 buckets, or Lambda functions.
True/False: SAML (Security Assertion Markup Language) is used for web browser single sign-on (SSO) using secure tokens.
• True
• False
Answer: True
Explanation: SAML stands for Security Assertion Markup Language. It is an open standard that allows identity providers to pass authorization credentials to service providers.
Multi-select: Which of the following applies to IAM roles?
• i) They cannot be used to delegate permissions to applications running on EC2 instances.
• ii) They are not associated with long-term credentials.
• iii) They can be assumed by federated users.
• iv) They allow you to delegate access to AWS resources.
Answer: ii) They are not associated with long-term credentials, iii) They can be assumed by federated users, iv) They allow you to delegate access to AWS resources.
Explanation: IAM roles allow you to delegate access to AWS resources, can be assumed by federated users, and do not have long-term credentials. However, it is incorrect that IAM roles cannot be used to delegate permissions to applications on EC2 instances; they can indeed be used for this purpose.
Interview Questions
What is IAM in the context of AWS?
IAM stands for Identity and Access Management. It is a feature of AWS that allows you to manage access to AWS services and resources securely.
What is multi-factor authentication in AWS?
Multi-factor authentication (MFA) in AWS is a security feature that requires users to present two separate forms of identification in order to access resources.
How can you enable MFA for a user in AWS?
MFA can be enabled for a user in AWS by navigating to the IAM dashboard, selecting the user, then the “Security Credentials” tab, and following the prompts to manage MFA.
What is the purpose of a password policy in AWS IAM?
A password policy in AWS IAM ensures that the user passwords comply with the best practices for security including length, complexity requirements, and rotation policies.
How can you set a custom password policy for IAM users in AWS?
A custom password policy can be set in IAM by selecting “Account settings” in the IAM dashboard and under “Password policy”, you can customize rules and requirements for your users’ passwords.
What is a role in AWS IAM?
A role in AWS IAM is an AWS identity with permission policies that determine what the identity can and cannot do in AWS.
What is SAML and how is it used with IAM in AWS?
SAML stands for Security Assertion Markup Language. It’s an open standard for exchanging authentication and authorization data between an identity provider and a service provider. In IAM, it allows you to create and manage users outside of AWS and grant them permissions to AWS resources.
What is federated identity with regard to AWS IAM?
Federated identity refers to the linking of a person’s electronic identity and attributes, stored across multiple distinct identity management systems. In AWS IAM, this allows users to authenticate using an external identity system and then access AWS resources without needing a separate IAM user account.
What are Resource Policies in AWS IAM?
Resource Policies are permissions policies you attach to a resource. They control what actions a specified principal can perform on that resource and under what conditions.
How are policy conditions used in IAM?
In IAM, policy conditions are optional statement elements that define when your policy is in effect. They can make permissions effective under certain circumstances (such as IP range, specific date, etc.)
How can AWS IAM increase the security of AWS resources?
AWS IAM increases the security of AWS resources by allowing control over who is authenticated and authorized to use resources. This can prevent unauthorized access and manage permissions at a granular level.
What is IAM federation?
IAM Federation is a method of granting external identities permissions to AWS resources without creating an IAM user for each identity, effectively bridging the gap between external systems and AWS services.
How can IAM roles be used for applications running on EC2 instances?
IAM roles can be used for applications running on EC2 instances by assigning the role to the instance at launch time. The assigned role provides temporary credentials that the application uses to make AWS API requests.
Can an IAM user belong to multiple groups?
Yes, an IAM user can belong to multiple groups, and it inherits the permissions of each group to which it belongs.
What happens when overlapping IAM policies grant contradictory permissions to a user?
When overlapping IAM policies grant contradictory permissions, the explicit deny takes precedence. If there is no explicit deny, the user has permission to perform the action.
extutorials.com