IAM best practices in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ security

intermediate

IAM Policy Scope Restriction

You have an IAM policy that allows full access to all S3 buckets. Which option correctly restricts access to only the bucket named my-company-data?

A {"Effect": "Allow", "Action": "s3:*", "Resource": ["arn:aws:s3:::my-company-data", "arn:aws:s3:::my-company-data/*"]}

B {"Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::*"}

C {"Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::my-company-data"}

D {"Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::my-company-data/*", "Condition": {"StringEquals": {"s3:prefix": "*"}}}

💡 Hint

Think about the difference between bucket and object ARNs in S3.

Option A correctly restricts access to all objects within the bucket my-company-data by specifying both the bucket ARN and the objects ARN with a trailing /*. Option A only allows access to the bucket itself, not the objects inside. Option A allows access to all buckets. Option A adds an unnecessary condition that does not restrict access properly.

✅ Best Practice

intermediate

IAM User vs Role Usage

Which option best describes when to use an IAM role instead of an IAM user?

A Use IAM users for applications running on EC2 instances needing AWS access.

B Use IAM roles only for human users logging in to AWS Console.

C Use IAM users for temporary access to AWS resources.

D Use IAM roles for applications running on EC2 instances needing AWS access.

💡 Hint

Think about temporary credentials and automatic rotation.

IAM roles provide temporary credentials and are ideal for applications running on AWS services like EC2. IAM users are for long-term credentials, typically for humans. Temporary access is best handled by roles, not users.

❓ Architecture

advanced

Designing Least Privilege Access

You need to design IAM policies for a team that manages EC2 instances but should not modify S3 buckets. Which approach follows the least privilege principle?

A Create a policy allowing all EC2 actions and deny all S3 actions explicitly.

B Create a policy allowing only necessary EC2 actions and do not include any S3 permissions.

C Create a policy allowing all EC2 and S3 actions but monitor usage with CloudTrail.

D Create a policy allowing all EC2 actions and grant read-only access to S3 buckets.

💡 Hint

Least privilege means granting only what is needed, nothing more.

Option B grants only the necessary EC2 permissions and does not grant any S3 permissions, which aligns with least privilege. Option B uses explicit deny which is less preferred if permissions can be omitted. Options C and D grant more permissions than needed.

❓ service_behavior

advanced

Effect of MFA on IAM User Access

An IAM user has a policy that requires MFA for deleting S3 buckets. What happens if the user tries to delete a bucket without MFA?

A The delete request triggers an alert but is allowed.

B The delete request succeeds because the user has delete permissions.

C The delete request is denied because MFA was not used.

D The delete request is logged but allowed without MFA.

💡 Hint

Consider how MFA conditions affect permission evaluation.

If a policy requires MFA for an action, the action is denied if MFA is not present in the request. So deleting without MFA fails.

🧠 Conceptual

expert

Cross-Account Access with IAM Roles

You want to allow an IAM user in Account A to access resources in Account B using an IAM role. Which configuration is required in Account B's role trust policy?

A The trust policy must allow the AWS account ID of Account A as a principal.

B The trust policy must allow the IAM role ARN from Account A as a principal.

C The trust policy must allow the IAM group ARN from Account A as a principal.

D The trust policy must allow the IAM user ARN from Account A as a principal.

💡 Hint

Think about how trust policies specify principals for cross-account roles.

Trust policies for cross-account roles typically specify the AWS account ID as the principal to allow any trusted identities from that account to assume the role.