Please enable JavaScript.
Coggle requires JavaScript to display documents.
IAM (Limits (1500 policies (300 groups (1000 roles (10 policies per role…
IAM
Limits
1500 policies
300 groups
1000 roles
10 policies per role.user
instance profiles 1000
2 access keys
10 groups per user
5k users
Best Practices
lock away aws account root user access keys
if you have to keep it roate the keys regularly
enable MFA
use groups to assign permissions
AWS Managed policies
DBfullaccess
IAMfullaccess
use custom policies use manged instead of inline
1 more item...
Resource Policies
IAM Policies
Implicit Deny
explicit Deny = denied
condition
ip
times
certain dynamoDB attributes
ID Policies
Permission Boundaries
set max permissions that an ID policy can grant to IAM entity
effective permissions
Evaluation
auth
process the request
eval policies
determine whether allow/deny
deny>allow
s3
website access
publicly readable
s3:getobject
for bucket policy
Read permissions to ALLUsers
20KB
testing s3 console need permisions
listtallmybuckets
1 more item...
Principal key
cross account access
KMS
Policy
32KB
NO IAM Groups
default
CMK
Management
Account and IAM Policies
Allow key admins to administer key
allow key users to use key
no policy = root user
IAM policies within account
Key Admin
Key usage
encrypt
decrypt
reencrypt
generatedatakey
describekey
create
describe
enable
put
update
delete
separates crypto operations
plaintext for initial encryption then deleted
data key is stored on the service
IAM
Bucket Policy
cross-account without IAM
20KB
can require objects be bucket owner's objects
ACL
owner still owns objects
other AWS resources other than s3
numerous buckets with different permissions
less than 2k for user
less than 5k for gorup
less than 10k for roles
ID federation
Web ID
exchange ID token for cognito
cognito for creds
access aws using creds
mobile dev
already have web identity
first going to IDP
SAML 2.0
SSO endpoint
STS
Console
Assume role
temp creds
Dynamodb
Parameter store
config and data separated from code
hierarchically
versioned
ec2/ecs/lambda
automated deployment cloud formation
serverless, resilient, scalable
S3 bucket cross account
403
no permissions to object