Scribd Logo
Upload

Welcome to Scribd!

  • 4 views

    AWS Assignment 1

    Uploaded by

    sobiakupey

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd

    AWS Assignment 1

    Uploaded by

    sobiakupey
    4 views2 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    4 views2 pages

    AWS Assignment 1

    Uploaded by

    sobiakupey

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Download as txt, pdf, or txt
    You are on page 1of 2

    Q1 What is the difference between IAM User and IAM Roles.

    Also mention their


    typical uses.

    IAM (Identity and Access Management) users and IAM roles are both entities within
    AWS (Amazon Web Services) IAM service, but they serve different purposes.

    IAM User:

    An IAM user represents a person or entity who interacts with AWS services.
    IAM users are associated with long-term credentials such as a username and
    password, or access keys.
    Typically, IAM users are used to grant access permissions to individuals or
    entities who need to interact with AWS resources on a regular basis, such as
    employees or contractors.
    IAM users are ideal for scenarios where you need to maintain distinct identities
    for each individual or entity accessing your AWS resources.
    IAM Role:

    An IAM role is similar to a set of permissions, but it is not associated with a


    specific user or group. Instead, it is assumed by users, services, or AWS
    resources.
    IAM roles are used to delegate permissions to entities that you trust. These
    entities can be IAM users, AWS services, or federated identities (such as users
    authenticated through an external identity provider).
    IAM roles are often used to grant temporary permissions to entities. For example,
    you can create a role that grants permissions to access specific S3 buckets, and
    then assign that role to an EC2 instance. This instance can then assume the role
    and access the S3 buckets without needing to store long-term credentials.
    IAM roles are commonly used for cross-account access, federated access, and for
    granting permissions to AWS services.

    Q2 What is an IAM Policy, How is it different from Service Control Policy

    IAM Policy and Service Control Policy (SCP) are both mechanisms used in AWS IAM
    (Identity and Access Management) to manage permissions, but they operate at
    different levels within the AWS account hierarchy.

    IAM Policy:

    An IAM policy is a JSON document that defines permissions for an individual IAM
    user, group, or role.
    IAM policies specify what actions are allowed or denied on which AWS resources.
    These policies can be attached directly to IAM users, groups, or roles, or they can
    be attached at the resource level (such as S3 bucket policies).
    IAM policies are used to grant permissions within a single AWS account. They are
    scoped to IAM entities and resources within that account.
    IAM policies can be granular, allowing fine-grained control over permissions, and
    they can be tailored to specific use cases or roles within an organization.
    Service Control Policy (SCP):

    A Service Control Policy (SCP) is a type of policy used in AWS Organizations to


    manage permissions across multiple AWS accounts within an organization.
    SCPs are attached to organizational units (OUs) or the root of an organization and
    apply to all accounts within that scope, including member accounts and any AWS
    services they use.
    SCPs are used to set permissions boundaries, restricting what actions and services
    are available to accounts within an organization.
    SCPs work in conjunction with IAM policies. While IAM policies define permissions
    at the account level, SCPs define permissions at the organizational level,
    controlling what actions are allowed or denied across all accounts within the
    organization.

    You might also like