IAM instance roles and IAM service roles

What is the difference between IAM service roles and IAM instance roles?

IAM instance roles are attached to EC2 instances to provide permissions that applications and services running on the instance need to interact with other AWS resources. IAM service roles are used by AWS services to interact on behalf of the user with other AWS services. Both types provide temporary credentials that automatically rotate, but the main difference is their purpose and the AWS entity they’re associated with.

How do you assign an IAM role to an EC2 instance?

You can assign an IAM role to an EC2 instance either during the launch process or by attaching it to an already-running instance through the EC2 management console, AWS CLI, or AWS SDK. This is done by selecting the desired IAM role in the “IAM role” dropdown menu within the EC2 launch configuration or modifying the instance’s settings.

What is the significance of using IAM roles with EC2 instances instead of storing AWS credentials on the instances themselves?

Using IAM roles enhances security because it avoids the need to store static, long-term AWS credentials (such as access keys) on EC2 instances. IAM roles provide temporary credentials that are automatically rotated and provided to the instance, reducing the risk of credential leakage or misuse.

Can an IAM role be shared across multiple EC2 instances? If so, what are the implications?

Yes, an IAM role can be shared across multiple EC2 instances. The implications are that any instance with the role attached will have the permissions defined in the role’s policy. This can make management easier, but you should design roles with the least privileges necessary to minimize security risks.

How do you limit the blast radius when assigning permissions to an IAM role for EC2 instances?

To limit the blast radius, you should follow the principle of least privilege and provide only the permissions necessary for the tasks the instance needs to perform. This might involve creating granular IAM policies, using condition keys for fine-grained control, and continuously auditing and revising permissions.

What is a best practice for auditing the use of IAM instance roles within your AWS environment?

A best practice for auditing the use of IAM instance roles is to regularly review and monitor the IAM role’s access using AWS CloudTrail, which logs the API calls for the account, including calls made by IAM roles. You should set up CloudTrail to deliver log files to an S3 bucket for analysis and set up alarms and notifications based on suspicious behavior patterns.

Can IAM roles be used with AWS Lambda to grant permissions to access other AWS resources? Explain how this works.

Yes, IAM roles can be used with AWS Lambda by creating an IAM role with the necessary permissions and then assigning it to the Lambda function. When the function executes, it assumes the specified IAM role and uses its permissions to access other AWS resources as needed.

Explain how to secure cross-account access using IAM roles.

To secure cross-account access using IAM roles, you should create an IAM role with the necessary permissions in the resource-owning account and establish a trust relationship to allow access from the other account(s). The trusted account can then assume the role and inherit its permissions, subject to any set conditions. This mechanism provides a secure way to grant access to resources without sharing long-term credentials.

When should you use an IAM service role instead of an IAM user?

An IAM service role should be used when an AWS service needs to perform actions on your behalf. This avoids using individual IAM user credentials, which can be cumbersome and less secure. Service roles provide a way for services to be granted only the permissions necessary to fulfill their intended tasks.

Describe how you would rotate the credentials associated with an IAM service role.

For IAM service roles, credential rotation is handled by AWS. Since the service role provides temporary security credentials for the service or application to access AWS resources, these credentials are automatically rotated by AWS, and the service retrieves new credentials as needed.

What are inline policies, and can they be used with IAM roles?

Inline policies are IAM policies that are directly embedded within a single IAM user, group, or role. They are not standalone policies but are an integral part of an IAM entity. Yes, inline policies can be used with IAM roles to provide specific permissions for a particular role. However, managed policies are recommended for ease of reuse and management.

Explain the security implications of improperly scoped IAM service roles.

Improperly scoped IAM service roles can lead to excessive permissions that exceed what is needed for a service to perform its operations, increasing the risk of privilege escalation and unauthorized access or actions. It’s important to scope IAM service roles with the principle of least privilege in mind, auditing them regularly and adjusting the permissions as necessary.