What is the purpose of IAM in AWS, and why is it important?

• Answer: IAM is used to control access to AWS resources securely. It helps manage who can do what on AWS, enforcing security best practices and minimizing unauthorized access.

What is the root account in AWS, and why should its use be minimized?

• Answer: The root account has full control over all AWS resources and permissions. Minimizing its use reduces the risk of accidental changes or misuse that could impact critical resources or configurations.

Can an IAM group contain other groups? Why or why not?

• Answer: No, an IAM group cannot contain other groups. IAM groups are intended to be simple collections of users, making it easier to manage permissions without complex group hierarchies.

What are IAM policies, and how are they structured?

• Answer: IAM policies are JSON documents that define permissions. They specify actions, resources, and conditions that determine what users or groups can access within AWS.

Explain the principle of least privilege. Why is it essential in IAM?

• Answer: The principle of least privilege means granting only the minimum permissions necessary. This minimizes the potential impact of security incidents by restricting access to only what users need.

Can an IAM user belong to multiple groups? Why might this be useful?

• Answer: Yes, a user can belong to multiple groups, which allows for flexible permission assignments, as a user can inherit different permissions from each group they are part of.

How would you grant temporary permissions to an IAM user?

• Answer: Temporary permissions can be granted through roles and session-based access with AWS Security Token Service (STS), which allows users to assume roles with specific permissions temporarily.

What is a managed policy vs. an inline policy in IAM?

• Answer: A managed policy is a standalone policy that can be attached to multiple users, groups, or roles, while an inline policy is embedded directly within a specific user, group, or role and applies only to that entity.