Assuming roles for temporary access in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the AWS CLI command to assume a role.

AWS

aws sts [1] --role-arn arn:aws:iam::123456789012:role/demo --role-session-name session1

Drag options to blanks, or click blank then click option'

Aget-session-token

Bassume-role

Clist-roles

Dget-caller-identity

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'get-session-token' which is for MFA tokens, not role assumption.

Using 'list-roles' which only lists roles but does not assume them.

The assume-role command is used to get temporary credentials by assuming an IAM role.

2fill in blank

medium

Complete the JSON policy snippet to allow assuming a role.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:[1]",
      "Resource": "arn:aws:iam::123456789012:role/demo"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AAssumeRole

BCreateRole

CListRoles

DGetRole

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'GetRole' which only retrieves role details but does not allow assuming it.

Using 'CreateRole' which is for creating roles, not assuming them.

The sts:AssumeRole action allows a user or service to assume the specified IAM role.

3fill in blank

hard

Fix the error in the AWS CLI command to assume a role with a session duration of 1 hour.

AWS

aws sts assume-role --role-arn arn:aws:iam::123456789012:role/demo --role-session-name session1 --duration-seconds [1]

Drag options to blanks, or click blank then click option'

A1800

B60

C7200

D3600

Attempts:

3 left

💡 Hint

Common Mistakes

Using 60 which is 1 minute, not 1 hour.

Using 7200 which is 2 hours, exceeding default max duration.

The --duration-seconds parameter expects the session duration in seconds. 1 hour equals 3600 seconds.

4fill in blank

hard

Fill both blanks to complete the trust policy that allows EC2 instances to assume a role.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "[1]"},
      "Action": "[2]"
    }
  ]
}

Drag options to blanks, or click blank then click option'

Aec2.amazonaws.com

Bsts:AssumeRole

Ciam:PassRole

Dlambda.amazonaws.com

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'iam:PassRole' which is for passing roles, not assuming them.

Using 'lambda.amazonaws.com' which is for Lambda service, not EC2.

The trust policy must specify the EC2 service as the principal and allow the sts:AssumeRole action for EC2 instances to assume the role.

5fill in blank

hard

Fill all three blanks to complete the Python boto3 code snippet that assumes a role and retrieves temporary credentials.

AWS

import boto3

client = boto3.client('sts')
response = client.[1](
    RoleArn='arn:aws:iam::123456789012:role/demo',
    RoleSessionName='session1'
)
credentials = response['[2]']
access_key = credentials['[3]']

Drag options to blanks, or click blank then click option'

Aassume_role

BCredentials

CAccessKeyId

Dget_caller_identity

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'get_caller_identity' which does not assume roles.

Accessing 'AccessKey' instead of 'AccessKeyId'.

The assume_role method is called to assume the role. The temporary credentials are in the 'Credentials' key, and the access key ID is accessed via 'AccessKeyId'.