Public deck

Cloud Engineering Fundamentals

The core ideas a cloud engineer works with every day: service models and regions, identity and access, virtual networks, compute, storage, managed databases, disaster recovery and cost. Examples use real AWS, Azure and Google Cloud service names.

Engineering

AShared by Alex Chen

0 Play Sign in to clone

You’re reading a free preview. Sign up to see every topic and question — and to play this deck as games.

See the whole deck

Identity and Access Management in the Cloud

How cloud providers decide who can do what: users, groups, roles and service accounts, how policies are written and evaluated, and how to grant only what is needed with short-lived credentials.

Play topic Back to deck

Content

41 total questions

MCQ: 10

Fill-in: 8

Flashcards: 12

Pair match: 11

Identity and Access Management in the Cloud – Flashcards

Flashcards

Card #1

Principal

Card #2

IAM user (AWS)

Card #3

IAM role (AWS)

9 more questions in this game

Showing 3 of 12. Sign up free to see the rest.

Identity and Access Management in the Cloud – MCQ

Multiple Choice Questions

1. A user's group policy allows s3:* on a bucket. A second policy attached to the user explicitly denies s3:DeleteObject on that bucket. Can the user delete objects?
- Yes, because the group allow was granted first
- No, because an explicit deny overrides any allow
- Yes, because s3:* is broader than one action
- Only if they sign in with MFA for that session
2. A developer's long-lived AWS access key is found in a public GitHub repository. What do you do first?
- Delete the repository, since the key is only dangerous while it is still visible
- Rotate the developer's console password, since the key depends on that password
- Make the repository private, then wait to see whether any unusual charges arrive
- Deactivate the key now, then check the audit logs for what it was used to do
3. An application on an EC2 instance needs to read objects from one S3 bucket. What is the recommended way to give it credentials?
- Create an IAM user and store its access key in the application config file
- Put the root user's access key in an environment variable on the instance
- Make the bucket public so the instance can read it with no credentials at all
- Attach an IAM role to the instance so the SDK fetches temporary credentials

7 more questions in this game

Showing 3 of 10. Sign up free to see the rest.

Identity and Access Management in the Cloud – Fill-in-the-blank

Fill in the Blank

1. In AWS, the API call an application makes to get temporary credentials for a role is sts:___.
Answer:AssumeRolealso: assume role, sts:AssumeRole
Hint: Two words joined: take on a role
2. Granting someone admin rights only for the hour they need them, then removing them automatically, is called just-in-___ access.
Answer:timealso: just-in-time
Hint: The phrase is also used in manufacturing
3. In Google Cloud, a role with a fixed set of permissions maintained by Google, such as roles/storage.objectViewer, is called a ___ role.
Answer:predefinedalso: pre-defined
Hint: Defined in advance, not by you

5 more questions in this game

Showing 3 of 8. Sign up free to see the rest.

Identity and Access Management in the Cloud – Pair match

Pair Match

Effect↔Allow or Deny in an AWS policy statement

Action↔The API operations a statement covers, such as s3:GetObject

Resource↔The ARNs that a statement applies to

8 more questions in this game

Showing 3 of 11. Sign up free to see the rest.