Bucket policies for access control in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the bucket name in the policy.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::[1]/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

Abucket-name

Barn:aws:s3:::my-example-bucket

Cmy-example-bucket

Ds3://my-example-bucket

Attempts:

3 left

💡 Hint

Common Mistakes

Including 'arn:aws:s3:::' in the bucket name option

Using 's3://' prefix in the bucket name

Using a placeholder like 'bucket-name' instead of the actual bucket name

The bucket name should be specified directly in the resource ARN after 'arn:aws:s3:::' followed by '/*' to indicate all objects.

2fill in blank

medium

Complete the code to specify the action that allows reading objects from the bucket.

AWS

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "[1]",
  "Resource": "arn:aws:s3:::my-example-bucket/*"
}

Drag options to blanks, or click blank then click option'

As3:PutObject

Bs3:ListBucket

Cs3:DeleteObject

Ds3:GetObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using 's3:PutObject' which allows uploading, not reading

Using 's3:ListBucket' which allows listing bucket contents but not reading objects

The action 's3:GetObject' allows users to read objects from the bucket.

3fill in blank

hard

Fix the error in the policy by choosing the correct principal to allow access to everyone.

AWS

{
  "Effect": "Allow",
  "Principal": [1],
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-example-bucket/*"
}

Drag options to blanks, or click blank then click option'

A"arn:aws:iam::123456789012:user/Alice"

B"*"

C"AWS"

D"root"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific user ARN instead of '*' for public access

Using 'AWS' or 'root' which are not valid principals for public access

The principal '*' means everyone, allowing public access.

4fill in blank

hard

Fill both blanks to restrict access to a specific IP address and allow only read actions.

AWS

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "[1]",
  "Resource": "arn:aws:s3:::my-example-bucket/*",
  "Condition": {
    "IpAddress": {
      "aws:SourceIp": "[2]"
    }
  }
}

Drag options to blanks, or click blank then click option'

As3:GetObject

Bs3:PutObject

C192.168.1.100/32

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using 's3:PutObject' which allows writing, not reading

Using '0.0.0.0/0' which allows access from anywhere

Use 's3:GetObject' to allow read access and specify the exact IP address with '/32' to restrict access.

5fill in blank

hard

Fill all three blanks to create a policy that denies delete actions for everyone except a specific AWS account.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "[1]",
      "Resource": "arn:aws:s3:::my-example-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": "[2]"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::[3]:root"},
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-example-bucket/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

As3:DeleteObject

B123456789012

C987654321098

Ds3:GetObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using 's3:GetObject' instead of 's3:DeleteObject' for deny action

Mixing up the AWS account IDs in the condition and principal

The policy denies delete actions to everyone except the AWS account '123456789012'. The allow statement grants full access to the account '123456789012'.

Practice

1. What is the main purpose of a bucket policy in AWS S3?

easy

A. To monitor the bucket usage statistics

B. To store files inside the bucket

C. To control who can access and perform actions on the bucket

D. To backup the bucket data automatically

Solution

1. Step 1: Understand bucket policy role

   A bucket policy defines permissions for users or services to access the bucket.

2. Step 2: Differentiate from other functions

   Storing files, monitoring, and backup are separate features, not controlled by bucket policies.

3. Final Answer:

   To control who can access and perform actions on the bucket -> Option C

4. Quick Check:

   Bucket policy = Access control [OK]

Hint: Bucket policies manage access permissions only [OK]

Common Mistakes:

• Confusing bucket policy with storage function
• Thinking bucket policy handles backups
• Assuming bucket policy monitors usage

2. Which of the following is the correct JSON key to specify who is allowed or denied access in a bucket policy?

easy

A. "Action"

B. "Principal"

C. "Resource"

D. "Effect"

Solution

1. Step 1: Identify the key for user or service

   The "Principal" key specifies the user, account, service, or entity the policy applies to.

2. Step 2: Differentiate from other keys

   "Action" defines allowed actions, "Resource" defines the bucket or objects, "Effect" states Allow or Deny.

3. Final Answer:

   "Principal" -> Option B

4. Quick Check:

   Who = Principal [OK]

Hint: Principal means who gets access [OK]

Common Mistakes:

• Confusing "Action" with "Principal"
• Using "Effect" to specify user
• Mixing up "Resource" with user identity

3. Given this bucket policy snippet, what does it allow?

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::example-bucket/*"
}

medium

A. Allows anyone to upload files to the bucket

B. Allows only the bucket owner to delete objects

C. Denies all access to the bucket

D. Allows anyone to read objects from the bucket

Solution

1. Step 1: Analyze the Effect and Principal

   Effect is "Allow" and Principal is "*" meaning everyone is allowed.

2. Step 2: Check the Action and Resource

   Action is "s3:GetObject" which means read access to objects in the bucket "example-bucket".

3. Final Answer:

   Allows anyone to read objects from the bucket -> Option D

4. Quick Check:

   Allow + * + GetObject = public read [OK]

Hint: Effect Allow + Principal * + GetObject = public read [OK]

Common Mistakes:

• Thinking GetObject allows uploads
• Confusing Allow with Deny
• Ignoring the wildcard * in Principal

4. You wrote this bucket policy but users still cannot upload files:

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "s3:PutObject",
  "Resource": "arn:aws:s3:::example-bucket"
}

What is the problem?

medium

A. The Resource ARN is missing the /* to specify objects

B. The Action s3:PutObject is invalid

C. The Principal cannot be * for uploads

D. Effect should be Deny to allow uploads

Solution

1. Step 1: Check the Resource ARN format

   To allow object uploads, Resource must include "/*" to specify objects inside the bucket.

2. Step 2: Validate Action and Principal

   s3:PutObject is valid, Principal "*" is allowed, and Effect "Allow" is correct.

3. Final Answer:

   The Resource ARN is missing the /* to specify objects -> Option A

4. Quick Check:

   PutObject needs resource with /* [OK]

Hint: Resource must end with /* for object actions [OK]

Common Mistakes:

• Using bucket ARN without /* for object actions
• Thinking Principal * is disallowed
• Confusing Allow and Deny effects

5. You want to create a bucket policy that denies all users except a specific AWS account (ID: 123456789012) from deleting objects in your bucket named "secure-bucket". Which policy snippet correctly enforces this?

hard

A. {
"Effect": "Deny",
"Principal": "*",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*",
"Condition": {
"StringNotEquals": {
"aws:PrincipalAccount": "123456789012"
}
}
}

B. {
"Effect": "Allow",
"Principal": {"AWS": "arn:aws:iam::123456789012:root"},
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*"
}

C. {
"Effect": "Deny",
"Principal": {"AWS": "arn:aws:iam::123456789012:root"},
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*"
}

D. {
"Effect": "Allow",
"Principal": "*",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::secure-bucket/*"
}

Solution

1. Step 1: Understand the requirement

   We want to deny delete actions to everyone except the specified account.

2. Step 2: Analyze each option

   { "Effect": "Deny", "Principal": "*", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*", "Condition": { "StringNotEquals": { "aws:PrincipalAccount": "123456789012" } } } denies delete to all principals except where the principal account equals 123456789012 using Condition StringNotEquals. This matches the requirement.
   { "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*" } allows only the specified account but does not deny others explicitly.
   { "Effect": "Deny", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*" } denies only the specified account, opposite of requirement.
   { "Effect": "Allow", "Principal": "*", "Action": "s3:DeleteObject", "Resource": "arn:aws:s3:::secure-bucket/*" } allows everyone, which is incorrect.

3. Final Answer:

   Option A correctly denies delete to all except the specified account -> Option A

4. Quick Check:

   Deny with Condition StringNotEquals excludes one account [OK]

Hint: Use Deny with Condition StringNotEquals for exceptions [OK]

Common Mistakes:

• Using Allow without Deny for blocking others
• Denying the allowed account by mistake
• Not specifying Condition for exceptions