on lab that provides you with practice configuring IAM by using the AWS Management Console

AWS operates, manages, and controls the components from the software virtualization layer down to the physical security of the facilities where AWS services operate.

AWS is responsible for protecting the infrastructure is composed of the hardware, software, networking, and facilities that run the AWS Cloud services.

The customer is responsible for the encryption of data at rest and data in transit

The customer should also ensure that the network is configured for security and that security credentials and logins are managed safely

the customer is responsible for the configuration of security groups and the configuration of the operating system that run on compute instances that they launch

AWS is responsible for protecting the global infrastructure :AWS Regions, Availability Zones, and edge locations.

Hardware infrastructure, such as servers, storage devices,

Software infrastructure, which hosts operating systems, service applications, and virtualization software.

Network infrastructure, such as routers, switches, load balancers, firewalls, and cabling.

AWS also continuously monitors the network at external boundaries, secures access points, and provides redundant infrastructure with intrusion detection

customers are responsible for security of everything they put in the cloud.

selecting and securing any instance operating systems, securing the applications that are launched on AWS resources, security group configurations, firewall configurations, network configurations, and secure account management

managing critical content security requirements, including: What content they choose to store on AWSWhich AWS services are used with the content In what country that content is stored, The format and structure of that content and whether it is masked, anonymized, or encrypted. Who has access to that content and how those access rights are granted, managed, and revoked

Infrastructure as a service (IaaS) refers to services that provide basic building blocks for cloud IT, typically including access to configure networking, computers (virtual or on dedicated hardware), and data storage space

Platform as a service (PaaS) refers to services that remove the need for the customer to manage the underlying infrastructure. Customers don’t need to worry about resource procurement, capacity planning, software maintenance, or patching

Software as a service (SaaS) refers to services that provide centrally hosted software that is typically accessible via a web browser, mobile app, or application programming interface (API). AWS Trusted Advisor, AWS Shield, and Amazon Chime

allows you to control access to compute, storage, database, and application services in the AWS Cloud.

specify exactly which API calls the user is authorized to make to each service.

manage which resources can be accessed by who , and how these resources can be accessed.

An IAM user is a person or application that is defined in an AWS account, and that must make API calls to AWS products

An IAM policy is a document that defines permissions to determine what users can do in the AWS account

Options for generating the MFA authentication token include virtual MFA-compliant applications(such as Google Authenticator or Authy 2-Factor Authentication), U2F security key devices, and hardware MFA devices. 

All actions in the account are denied to the user by default

Any actions that you explicitly deny are always denied.

The principle of least privilege :you grant only the minimal user privileges needed to the user

Resource - based policies are JSON policy documents that you attach to a resource

Managed policies –Standalone identity-based policies that you can attach to multiple users, groups, and roles in your AWS account

Inline policies –Policies that you create and manage, and that are embedded directly into a single user group or role.

AWS account root users have (and retain) full access to all resources in the account. Therefore, AWS strongly recommends that you do not use account root user credentials for day-to-day interactions with the account

Instead, AWS recommends that you use IAM to create additional users and assign permissions to these users, following the principle of least privilege

You should avoid sharing the same credentials with multiple users.

MFA- compliant applications (such as Google Authenticator and Authy Authenticator), U2F security key devices, and hardware MFA options that provide a key fob or display card.

AWS CloudTrail is a service that logs all API requests to resources in your account.

enable billing reports, such as the AWS Cost and Usage Report.

Use groups to assign permissions to IAM users.•Configure a strong password policy.•Delegate using roles instead of sharing credentials