Assuming roles for temporary access in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the duration of temporary credentials when assuming a role with AWS STS by default?

When you use AWS Security Token Service (STS) to assume a role without specifying the duration, how long do the temporary credentials last by default?

A 12 hours

B 1 hour and 15 minutes

C 1 hour

D 15 minutes

💡 Hint

Think about the default session duration for AssumeRole API calls.

By default, AWS STS issues temporary credentials valid for 1 hour when assuming a role unless a different duration is specified.

❓ security

intermediate

Which AWS policy element allows a user to assume a specific role?

To allow a user to assume an IAM role, which policy action must be included in the user's permissions?

A "sts:AssumeRole"

B "iam:PassRole"

C "iam:AssumeRolePolicy"

D "sts:GetSessionToken"

💡 Hint

Look for the STS action that grants role assumption capability.

The action "sts:AssumeRole" is required to allow a user or service to assume an IAM role.

❓ Architecture

advanced

Which trust policy snippet correctly allows an EC2 instance to assume a role?

Given an IAM role trust policy, which snippet correctly allows EC2 instances to assume the role?

A { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" }

B { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/EC2User" }, "Action": "sts:AssumeRole" }

C { "Effect": "Allow", "Principal": { "Service": "ecs.amazonaws.com" }, "Action": "sts:AssumeRole" }

D { "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" }

💡 Hint

Which AWS service represents EC2 in trust policies?

The service principal for EC2 is "ec2.amazonaws.com" in the trust policy to allow EC2 instances to assume the role.

✅ Best Practice

advanced

What is the recommended maximum session duration for an IAM role to minimize risk?

To reduce security risks, what is the best practice for setting the maximum session duration for an IAM role?

A Set maximum session duration to 1 hour or less to limit exposure of temporary credentials

B Set maximum session duration to 12 hours to reduce frequent re-authentication

C Set maximum session duration to 24 hours for convenience

D Set maximum session duration to 7 days to avoid interruptions

💡 Hint

Shorter sessions reduce the window for compromised credentials.

Short session durations limit the time temporary credentials are valid, reducing risk if credentials are exposed.

🧠 Conceptual

expert

What happens if you try to assume a role with an expired session token?

If you use AWS STS to assume a role but provide an expired session token, what is the expected behavior?

A The AssumeRole call succeeds but credentials are invalid when used

B The AssumeRole call fails with an "ExpiredToken" error

C The AssumeRole call succeeds and returns new credentials ignoring the expired token

D The AssumeRole call returns credentials with reduced permissions

💡 Hint

Expired tokens cannot be used to get new credentials.

AWS STS rejects AssumeRole calls with expired tokens and returns an "ExpiredToken" error.