Bucket policies for access control in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the bucket name in the policy.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::[1]/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

Abucket-name

Barn:aws:s3:::my-example-bucket

Cmy-example-bucket

Ds3://my-example-bucket

Attempts:

3 left

💡 Hint

Common Mistakes

Including 'arn:aws:s3:::' in the bucket name option

Using 's3://' prefix in the bucket name

Using a placeholder like 'bucket-name' instead of the actual bucket name

The bucket name should be specified directly in the resource ARN after 'arn:aws:s3:::' followed by '/*' to indicate all objects.

2fill in blank

medium

Complete the code to specify the action that allows reading objects from the bucket.

AWS

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "[1]",
  "Resource": "arn:aws:s3:::my-example-bucket/*"
}

Drag options to blanks, or click blank then click option'

As3:PutObject

Bs3:ListBucket

Cs3:DeleteObject

Ds3:GetObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using 's3:PutObject' which allows uploading, not reading

Using 's3:ListBucket' which allows listing bucket contents but not reading objects

The action 's3:GetObject' allows users to read objects from the bucket.

3fill in blank

hard

Fix the error in the policy by choosing the correct principal to allow access to everyone.

AWS

{
  "Effect": "Allow",
  "Principal": [1],
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::my-example-bucket/*"
}

Drag options to blanks, or click blank then click option'

A"arn:aws:iam::123456789012:user/Alice"

B"*"

C"AWS"

D"root"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific user ARN instead of '*' for public access

Using 'AWS' or 'root' which are not valid principals for public access

The principal '*' means everyone, allowing public access.

4fill in blank

hard

Fill both blanks to restrict access to a specific IP address and allow only read actions.

AWS

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "[1]",
  "Resource": "arn:aws:s3:::my-example-bucket/*",
  "Condition": {
    "IpAddress": {
      "aws:SourceIp": "[2]"
    }
  }
}

Drag options to blanks, or click blank then click option'

As3:GetObject

Bs3:PutObject

C192.168.1.100/32

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using 's3:PutObject' which allows writing, not reading

Using '0.0.0.0/0' which allows access from anywhere

Use 's3:GetObject' to allow read access and specify the exact IP address with '/32' to restrict access.

5fill in blank

hard

Fill all three blanks to create a policy that denies delete actions for everyone except a specific AWS account.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "[1]",
      "Resource": "arn:aws:s3:::my-example-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": "[2]"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {"AWS": "arn:aws:iam::[3]:root"},
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-example-bucket/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

As3:DeleteObject

B123456789012

C987654321098

Ds3:GetObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using 's3:GetObject' instead of 's3:DeleteObject' for deny action

Mixing up the AWS account IDs in the condition and principal

The policy denies delete actions to everyone except the AWS account '123456789012'. The allow statement grants full access to the account '123456789012'.