IAM, KMS, VPC security groups and NACLs, Cognito, WAF and Shield, encryption at rest and in transit and secrets management for the Solutions Architect Associate.
40 cards · basic cards · AI-written, checked twice. Edit anything.
- What are the three types of IAM identities in AWS?
Show answer
AWS accounts, IAM users, and IAM roles.- How do IAM users differ from IAM roles?
Show answer
Users have long-term credentials and are for people or applications; roles have temporary credentials and can be assumed by users or services.- What is the default behavior in IAM policy evaluation when no explicit allow exists?
Show answer
Deny; all requests are implicitly denied unless an explicit allow policy exists.- What does the IAM AssumeRole action do?
Show answer
It allows an IAM identity to temporarily assume another IAM role and use that role's permissions.- What is an IAM permission boundary?
Show answer
A managed policy that defines the maximum permissions an IAM user or role can have; it filters but does not grant permissions.- What is the AWS Security Token Service (STS)?
Show answer
A service that provides temporary, limited-privilege credentials for accessing AWS resources, used for federated access and cross-account roles.- When multiple IAM policy evaluation results occur, which takes precedence: explicit deny, explicit allow, or implicit deny?
Show answer
Explicit deny; a single explicit deny overrides all allows.- What does AWS Key Management Service (KMS) do?
Show answer
Manages cryptographic keys and provides encryption and decryption operations without exposing key material to users.- What is the difference between AWS-managed keys and customer-managed keys in KMS?
Show answer
AWS-managed keys are created and maintained by AWS for specific services; customer-managed keys are created and fully controlled by the user.- What is a data key in the context of AWS KMS?
Show answer
A key generated by KMS that encrypts actual user data; the data key itself is then encrypted with a KMS master key.- What is envelope encryption?
Show answer
A method where data is encrypted with a data key, and the data key itself is encrypted with a master key, reducing the need to send large amounts of data to KMS.- Can you view the plaintext of a KMS master key?
Show answer
No; KMS never allows you to view the plaintext of a master key, only to use it for encrypt and decrypt operations.- What is key rotation in AWS KMS?
Show answer
The process of replacing a KMS key with a new key; it improves security by limiting the amount of data encrypted with a single key version.- What are the two main types of KMS keys based on algorithm?
Show answer
Symmetric keys (single key for encrypt and decrypt) and asymmetric keys (public and private key pairs).- What is a VPC security group?
Show answer
A stateful firewall that controls inbound and outbound traffic at the instance level (network interface level).
FlashKeepers