IAM Identity Center quiz · Level 0

Question 1Todo.io hires five engineers who need access to both the Dev and Prod accounts, with less access in Prod. What is the recommended way to set this up?

Create each engineer once in IAM Identity Center, and assign permission sets per account: a broader one in Dev, a narrower one in Prod.Correct. Identity Center gives each person one sign-in for every account. A permission set becomes a role in each account it is assigned to.Create an IAM user for each engineer in each account.Not this one. That is ten users, ten passwords and ten sets of keys to manage. It works, but it is the older way.Create one shared admin IAM user in each account and give everyone the password.Not this one. Shared credentials hide who did what in CloudTrail, and give everyone more access than they need.Give the engineers the root user's MFA device, so access is still protected by MFA.Not this one. Root can do almost anything, and must not be used for daily work by anyone.

Learn it: IAM Identity Center · Permission set · Set up AWS: Day 0

Question 2An engineer signs in to the IAM Identity Center access portal and opens the Prod account. What credentials do they get in Prod?

Temporary credentials for a role that Identity Center created from their permission set.Correct. Signing in means assuming a role, so the credentials expire on their own. No long-lived keys exist to leak.The password of an IAM user in Prod.Not this one. Identity Center doesn't create IAM users in the accounts.Permanent access keys for Prod.Not this one. Nothing here is permanent. That's the point.The Prod root user's credentials.Not this one. Root is never handed out by Identity Center.

Learn it: IAM Identity Center · Temporary credentials

Question 3Todo.io already manages its staff in Okta. It wants people to sign in to AWS with the same accounts, and leavers to lose AWS access when they are removed from Okta. What should it do?

Connect Okta to IAM Identity Center as its identity source.Correct. Identity Center can use an external directory instead of its own. One place to add and remove people.Create an IAM user in each account for every Okta user.Not this one. That duplicates every person, and removing someone from Okta wouldn't remove their IAM users.Use Amazon Cognito.Not this one. Cognito is for an app's own customers (Level 2), not for staff signing in to AWS.Share one AWS sign-in among everyone who is in Okta.Not this one. Shared sign-ins hide who did what, and can't be taken from one leaver.

Learn it: IAM Identity Center

Question 4An engineer leaves Todo.io. They had access to all six accounts through IAM Identity Center. What is the quickest way to remove their access everywhere?

Disable or delete their user once: in Identity Center, or in the company directory it is connected to.Correct. One identity, one place to remove it. Sessions already open run out when their temporary credentials expire.Delete their IAM user in each of the six accounts.Not this one. They don't have IAM users; Identity Center gives them roles.Change the root password of every account.Not this one. They never had root, so this changes nothing for them.Delete the permission sets they used.Not this one. That removes access for everyone else who uses those permission sets too.

Learn it: IAM Identity Center

Question 5Todo.io expects 50,000 people to sign up to manage their todos. Should those customers be created in IAM Identity Center?

No. Identity Center and IAM are for people and software that manage or call AWS. App customers belong to the app.Correct. Customer sign-up and login is the app's job; Amazon Cognito does it in Level 2.Yes. Identity Center is built for large numbers of users.Not this one. It's built for staff who sign in to AWS accounts, not for an app's customers.Yes, as IAM users, so each customer has their own permissions.Not this one. Customers should never be IAM principals.Yes, with one permission set per customer.Not this one. Customers don't sign in to AWS accounts at all.

Learn it: IAM Identity Center · IAM

Question 6Roles named AWSReservedSSO_AdministratorAccess_… appear in Todo.io's Prod account. Where did they come from?

IAM Identity Center created them when a permission set was assigned in Prod.Correct. Identity Center was formerly called AWS SSO, hence the name. Change them through the permission set, not by hand.An attacker created them.Not this one. The AWSReservedSSO_ prefix is reserved for Identity Center.RDS created them as service-linked roles.Not this one. Service-linked roles are named AWSServiceRoleFor…Account Factory creates them in every account.Not this one. Account Factory sets up sign-in, but these roles come from permission set assignments.

Learn it: IAM Identity Center

Question 7What does an engineer see after signing in to the IAM Identity Center access portal?

The accounts they are assigned to, and the permission sets they can use in each.Correct. They pick an account and a permission set, and land in the console as that role.Every account in the organization, with administrator access to each.Not this one. They see only what has been assigned to them.Only the management account.Not this one. Staff rarely need the management account at all.A list of IAM users to sign in as.Not this one. There are no IAM users; access is through roles.

Learn it: IAM Identity Center

Question 8What does "IAM Identity Center" mean?

One place for people to sign in and get access to many AWS accounts.Correct. Think of it as: The front desk that hands you a temporary key card for whichever flat you're cleared for.An organization-wide guardrail that sets the most any identity in an account may do.Not this one. That describes SCP (service control policy).A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Not this one. That describes Permission set.Groups many AWS accounts under one management account, with one bill and shared guardrails.Not this one. That describes AWS Organizations.

Learn it: IAM Identity Center

Question 9Which term is this? "One place for people to sign in and get access to many AWS accounts."

IAM Identity CenterCorrect. Yes. Think of it as: The front desk that hands you a temporary key card for whichever flat you're cleared for.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails.

Learn it: IAM Identity Center

Question 10Which AWS term is described by this analogy? "The front desk that hands you a temporary key card for whichever flat you're cleared for."

IAM Identity CenterCorrect. Yes: One place for people to sign in and get access to many AWS accounts.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do. Its analogy: The building's rules. Your lease can't give you permission to break them.Permission setNot this one. Permission set is: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to. Its analogy: A job description that comes with the right keys in every building.AWS OrganizationsNot this one. AWS Organizations is: Groups many AWS accounts under one management account, with one bill and shared guardrails. Its analogy: The building management company that owns every flat.

Learn it: IAM Identity Center

IAM Identity Center

Worth another look

Your weak spots

Services

Concepts