Section 2.3 - AWS Certified Cloud Practitioner Study Guide
Tags: aws, cloudskills, examprep, cloud
Published: 2022-02-24 19:35:52

**This series is intended to be a personal study guide. Information may not be comprehensive or accurate. I am sharing it in case others find it useful. Please feel free to comment if any information is inaccurate.**

[Return to Exam Guide](https://dev.to/aidutcher/aws-certified-cloud-practitioner-study-guide-exam-guide-outline-233o)

**<u>2.3 Identify AWS access management capabilities</u>**

**Understand the purpose of User and Identity Management**

- _Access keys and password policies (rotation, complexity)_
     - [Access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html)
          - Long-term credentials for IAM users
          - Sign programmatic requests
          - Consist of a key ID and a secret access key
     - [Password policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html)
          - Temporary credentials are best practice
          - IAM policies can require password rotation and 
            length/complexity
- [_Multi-Factor Authentication (MFA)_](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)
     - Requires authentication in addition to sign-in credentials
     - Virtual MFA devices
     - U2F security key (physical usb device)
     - Hardware MFA device
- [_AWS Identity and Access Management (IAM)_]((https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html))
     - [Groups/users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) - can assign specific permissions per 
                      user/group
     - [Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) - can create permissions that are assumed when a 
               specific task is performed
     - [Policies, managed and custom](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) - policies define permissions 
               that are assigned when associated with an identity 
               or resource
          - [Identity-based](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_id-based) - attached to an IAM user, group, or 
                             role
          - [Resource-based](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_resource-based) - attached to a resource
          - [Permissions boundaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) - set the maximum permissions that an identity- 
                   based policy can grant
          - [Organizations SCPS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_scp) - SCPs are JSON policies that specify the maximum permissions for an organization or organizational unit
          - [ACLs](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_acl) - service policies that allow you to control which principals in another account can access a resource
          - [Session policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) - advanced policies that you pass as a parameter when you programmatically create a temporary session for a role or federated user
- [_Tasks that require use of root accounts_](https://docs.aws.amazon.com/accounts/latest/reference/root-user-tasks.html)
     - Change account settings
     - Restore IAM user permissions
     - Activate IAM access to the Billing and Cost Management 
     console
     - View tax invoices
     - Close AWS account
     - Change or cancel support plan
     - Register as a seller
     - Configure S3 bucket to enable MFA
     - Edit or delete S3 bucket policy that includes an invalid 
     VPC ID
     - Sign up for [GovCloud](https://aws.amazon.com/govcloud-us/?whats-new-ess.sort-by=item.additionalFields.postDateTime&whats-new-ess.sort-order=desc)
- _Protection of root accounts_
     - Limit tasks performed with root user
     - Lock away root user access keys
     - Use a strong password
     - Enable MFA

[Return to Exam Guide](https://dev.to/aidutcher/aws-certified-cloud-practitioner-study-guide-exam-guide-outline-233o)