Please enable JavaScript.
Coggle requires JavaScript to display documents.
Phần 4: IAM - global service, Root account created by default, should not…
Phần 4: IAM - global service
Group
only contain user, not other group
1 user don't have to belong to a group or it can belong to multiple group
Permission
Can assign json document call policy
Don't give permission more than user needs
Inline policy
: attach only for 1 user
4.13
: Policies - for User/Group
Version
Id
Statement
Statement id
Effect(Allow/Deny)
Principal (Account/user/role apply to)
List action allow/deny
List resource apply this policy
Condition when this policy apply
4.15
: MFA = password you know + device you own
Device Options
Virtual MFA device (Support multi token in single device)
Google authenticator (phone only)
Authy (multi device)
Universal 2nd Factor
YubiKey
Hardware Key Fob
Hardware Key Fob for GovCloud
How to access
Management Console: password + MFA
CLI: protect by access key (Generated by AWS console)
SDK: access key - for code
4.24
: Roles - for Services
EC2 roles
Lambda roles
4.26
: Security Tool
Credentials Report (Account level)
Access Advisor (User level)
Root account created by default, should not use or share