AWS IAM - Revision history

Mflavell at 16:35, 9 February 2026

2026-02-09T16:35:43Z

← Older revision		Revision as of 16:35, 9 February 2026
Line 82:		Line 82:

	** This allows for overlap - use of old key for a short period.		** This allows for overlap - use of old key for a short period.


			* Use GIT secrets

			** Prevents secret access keys from been added to code.

			** Secrets are flagged before been pused to GIT repo.

			** Enables the secret to be removed and stored in AWS Secrets manager by the developer.

Mflavell at 16:31, 9 February 2026

2026-02-09T16:31:11Z

← Older revision		Revision as of 16:31, 9 February 2026
Line 73:		Line 73:
	* AWS apps can seamlessly integrate into Identity center.		* AWS apps can seamlessly integrate into Identity center.
	* Creates an SSO experience.		* Creates an SSO experience.


			= Mitigation of issues =

			* Create a policy to rotate keys every 90 days.

			** Two sets of keys can be assigned per user.

			** This allows for overlap - use of old key for a short period.

Mflavell at 19:42, 13 June 2025

2025-06-13T19:42:16Z

← Older revision		Revision as of 19:42, 13 June 2025
Line 72:		Line 72:

	* AWS apps can seamlessly integrate into Identity center.		* AWS apps can seamlessly integrate into Identity center.
	* Creates an SSO ~~expereice~~.		* Creates an SSO experience.

Mflavell at 22:36, 11 June 2025

2025-06-11T22:36:29Z

← Older revision		Revision as of 22:36, 11 June 2025
Line 61:		Line 61:
	This is a trusted intermediary that issues temporary security credentials.		This is a trusted intermediary that issues temporary security credentials.

			* Allows the implementation of least privilege.
			* Credentials can expire after a set period.
			* Can integrate with external IDPs.
			* Scales easily.

	* Allows the implementation of least privilege.

	* Credentials can expire after a set period.		= IAM Identity Center =

	* Can integrate with external IDPs.		This simplifies permissions across multiple AWS accounts.

	* ~~Scales easily~~.		* AWS apps can seamlessly integrate into Identity center.
			* Creates an SSO expereice.

Mflavell: /* Security Token Service */

2025-06-11T22:31:28Z

Security Token Service

← Older revision		Revision as of 22:31, 11 June 2025
Line 58:		Line 58:

	= Security Token Service =		= Security Token Service =

			This is a trusted intermediary that issues temporary security credentials.


			* Allows the implementation of least privilege.

			* Credentials can expire after a set period.

			* Can integrate with external IDPs.

			* Scales easily.

Mflavell at 22:24, 11 June 2025

2025-06-11T22:24:49Z

← Older revision		Revision as of 22:24, 11 June 2025
Line 36:		Line 36:
	* Set permission guardrails.		* Set permission guardrails.
	* Use permission boundaries.		* Use permission boundaries.


	= Root account =		= Root account =
Line 45:		Line 46:
	* It is best not to use the root account for daily activities.		* It is best not to use the root account for daily activities.
	* Create another account that has admin rights.		* Create another account that has admin rights.


	= Users groups and Roles =		= Users groups and Roles =

	* Users - Individual ~~identierties~~.		* Users - Individual identities.
	* Roles = provide ~~teporary~~ permissions.		* Roles = provide temporary permissions.
	:* Useful for ~~teporary~~ access to services		:* Useful for temporary access to services
	* Groups - Logical collections of users.		* Groups - Logical collections of users.
	:* Simplify permission ~~manaagement~~.		:* Simplify permission management.


			= Security Token Service =

Mflavell at 23:22, 10 June 2025

2025-06-10T23:22:03Z

← Older revision		Revision as of 23:22, 10 June 2025
Line 36:		Line 36:
	* Set permission guardrails.		* Set permission guardrails.
	* Use permission boundaries.		* Use permission boundaries.

			= Root account =

			* Risks often arrise from root account creditials.
			* Improper storage of credientals (eg a text file)
			* Once efiltrated the person with the credientals has full access.

			* It is best not to use the root account for daily activities.
			* Create another account that has admin rights.

			= Users groups and Roles =

			* Users - Individual identierties.
			* Roles = provide teporary permissions.
			:* Useful for teporary access to services
			* Groups - Logical collections of users.
			:* Simplify permission manaagement.

Mflavell: /* Best Practices */

2025-06-09T22:41:56Z

Best Practices

← Older revision		Revision as of 22:41, 9 June 2025
Line 35:		Line 35:
	* Use conditions to restrict access.		* Use conditions to restrict access.
	* Set permission guardrails.		* Set permission guardrails.
			* Use permission boundaries.

Mflavell at 22:41, 9 June 2025

2025-06-09T22:41:28Z

← Older revision		Revision as of 22:41, 9 June 2025
Line 14:		Line 14:
	* Enteritis - Can be an IAM user or federated user.		* Enteritis - Can be an IAM user or federated user.
	* Identities - Used to identify who id doing something. These are users, groups and roles.		* Identities - Used to identify who id doing something. These are users, groups and roles.


			= IAM Authentication Methods =

			* Username and Password
			* Access Key and secret key
			* Session token


			= Best Practices =

			* Humans should access AWS using an IDP - provides access with temporary credentials.
			* Workloads use temporary credentials
			* Require MFA
			* Don't use root credentials for everyday tasks.
			* Apply least privilege.
			* Use AWS managed polices when possible.
			* Use AWS access manager to generate least privilege polices
			* Perform a regular review of IAM.
			* Use conditions to restrict access.
			* Set permission guardrails.

Mflavell: Created page with "Study Guides > AWS Cybersecurity Notes > AWS IAM = IAM Introduction = * Polices rule books :* These define what actions are allowed and denied on resources. IAM Supports MFA and Federation. Common terms: * Resources - Something inside the AWS account. * Enteritis - Can be an IAM user or federated user. * Identities - Used to identify who id doing something. These are users, groups and roles."

2025-06-09T22:19:46Z

Created page with "Study Guides > AWS Cybersecurity Notes > AWS IAM = IAM Introduction = * Polices rule books :* These define what actions are allowed and denied on resources. IAM Supports MFA and Federation. Common terms: * Resources - Something inside the AWS account. * Enteritis - Can be an IAM user or federated user. * Identities - Used to identify who id doing something. These are users, groups and roles."

New page

[[Study Guides]] > [[AWS Cybersecurity Notes]] > AWS IAM

= IAM Introduction =

* Polices rule books
:* These define what actions are allowed and denied on resources.

IAM Supports MFA and Federation.

Common terms:
* Resources - Something inside the AWS account.
* Enteritis - Can be an IAM user or federated user.
* Identities - Used to identify who id doing something. These are users, groups and roles.