Content Domain 2: Security and Compliance

Task Statement 2.3: Identify AWS access management capabilities

Let's get started with the third task statement to identify AWS access management capabilities. There are a few different things you should make sure you understand and can explain for this task statement. First, you should understand the need for user and identity management. So, why do you need to have tools to control user access? We mentioned earlier that not everyone who uses an AWS account needs the same level of access, and in order to control how people use AWS services within an account you need a way to control the level of access they have. For example, someone who is an analyst likely won't need administrator access for the service Amazon EC2 like a systems administrator may need. You should familiarize yourself with the concept of principle of least privilege, where you only give users exactly the level of access, they need to do their work and nothing more. Security is another fundamental needed for this exam along with user and identity management, it's all about knowledge of AWS Identity and Access Management. You should know the features of AWS IAM, how it enables you to control access to your AWS account, and when to use the different aspects of IAM based on the use case. A fundamental understanding of AWS accounts is needed for this exam. AWS accounts may seem like a very basic understanding but what accounts are and how they work are crucial because as a cloud practitioner and as a solutions architect you will encounter very simple systems operating in a single AWS account, but you will also encounter more complex systems that use tens or even hundreds of AWS accounts. An AWS account is where you provision your services, it is also where your AWS services log their usage to and also with an AWS account you can log into that environment. And these services you provision in your account generate a bill and that is billed to you from the payment method you choose when you create your account. Remember that is the fifth criteria of cloud computing we covered in our first lesson. It is also important to understand that when you create your AWS account, it is yours. And only yours until you grant access to others. AWS accounts by default do not have permissions until you explicitly grant those permissions. When you create an AWS account, you begin with a sign-in identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account root user. For the exam, you need to be able to explain how the root user is different from other types of users within the AWS account. The root user has complete and unrestricted access to all resources in an AWS account, but you should not be using this user to carry out daily tasks in AWS. Because of this unrestricted access, it's incredibly important that every cloud practitioner knows how to protect root users, when to use the root user, and when not to use the root user. For the exam, ensure you have studied the different ways you can lock down your AWS account root user to protect it. This includes the use of multi-factor authentication, securely locking away the root user credentials, rotating access keys and the password for the root user, and simply not using this root user for daily tasks but instead AWS recommends that you configure an admin user in AWS IAM Identity Center to perform daily tasks and access AWS resources. There are a limited number of tasks that require root user access, and you should be familiar with what those tasks are. For the exam, know which tasks you can perform as the root user of an account. You can: change your account settings, restore IAM user permissions, activate IAM access to the Billing and Management console, and more. You can also create an account alias in IAM which substitutes the account ID in the web address for your account for IAM users. Secondly, you should know the different features AWS IAM has to offer and understand when you would use them. The features I am referring to are: IAM users, groups, roles, and policies. You should be able to explain things like how IAM users have associated usernames and passwords, access keys for programmatic access, how users can have MFA enabled for their login, and how you can enforce password complexity and access key and password rotation. Know how to organize users into groups and how that affects permissions when AWS actions are taken. You need to know how permissions in AWS work and how you can apply IAM policies to users, groups, or roles and the impact that has on an entity's access. I mention IAM roles, and it's something you should be very familiar with before attempting the exam. Roles are temporary credentials that can be assumed by various entities and have many use cases. For example, some use cases are: a user can assume a role to gain temporary access to permissions, a program can assume a role to gain access to AWS credentials to make AWS API calls, or you can use roles for cross-account access. Do you know when it is better to use an IAM role rather than an IAM user? IAM roles can be used to provide AWS services permissions to do certain actions and also to give outside entities permissions to perform actions in your AWS account. Here is another question. What AWS service can you use to provide temporary AWS credentials for users that have been authenticated through their social media logins and guest users who do not require authentication. Amazon Cognito and specifically Amazon Cognito Identity Pool can provide temporary AWS credentials for this use case. Diving deeper, Amazon Cognito User Pool is a user directory in Amazon Cognito and it doesn't enable access to unauthenticated identities. You have to use an Identity Pool instead. Third, understand IAM policies. There are different types of IAM policies in AWS, managed policies and unmanaged. You should know the difference between the two types of policies, who can create each type of policy, and who can edit or modify each type of policy. AWS creates and manages managed policies whereas customers create and manage regular IAM policies. Related to IAM policies, there is an AWS service you can use to test and troubleshoot IAM and resource-based policies. Do you know what that service is? It is the IAM Policy Simulator. Also, what if you need to add security to your Amazon S3 bucket to only allow access for specific users, do you create an IAM role, IAM user policy, or a bucket policy? Well, bucket policies are a type of resource-based policy and they differ from IAM roles. Bucket policies and user policies are two of the access policy options available for you to grant permission to your Amazon S3 resources. Both use JSON-based access policy language. You add a bucket policy to a bucket to grant other AWS accounts or IAM users access permissions for the bucket and the objects in the bucket. User policies are policies that allow an IAM user access to one of your buckets. Let's stay on Amazon S3 and see if you can answer this one. If one of your objects was accidentally deleted from your S3 bucket, what can you implement to prevent unauthorized deletion of any other objects from your bucket? You can configure MFA delete on your S3 bucket which adds an extra layer of protection, but you must enable versioning for your objects first. Once you understand AWS accounts it is easier to understand how to manage and secure access. Let's get started with the fourth task statement and talk about components and resources for security.