IAM best practices in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an IAM user with programmatic access.

AWS

aws iam create-user --user-name [1]

Drag options to blanks, or click blank then click option'

AAdminUser

BDefaultUser

CRootUser

DMyUser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'RootUser' as an IAM user name

Leaving the user name blank

The command creates an IAM user named 'MyUser'. Avoid using 'RootUser' as a user name because root access should be limited.

2fill in blank

medium

Complete the code to attach a policy that grants read-only access to S3.

AWS

aws iam attach-user-policy --user-name MyUser --policy-arn [1]

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::aws:policy/AmazonEC2FullAccess

Barn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Carn:aws:iam::aws:policy/AdministratorAccess

Darn:aws:iam::aws:policy/IAMFullAccess

Attempts:

3 left

💡 Hint

Common Mistakes

Using AdministratorAccess which grants too many permissions

Using policies unrelated to S3

The policy ARN 'AmazonS3ReadOnlyAccess' grants read-only permissions to S3 resources, following the principle of least privilege.

3fill in blank

hard

Fix the error in the policy JSON to allow only listing S3 buckets.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "[1]",
      "Resource": "*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

As3:DeleteBucket

Bs3:PutObject

Cs3:ListAllMyBuckets

Ds3:GetObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using actions that allow deleting or modifying buckets

Using object-level permissions instead of bucket-level

The action 's3:ListAllMyBuckets' allows listing all buckets in the account, which is the correct permission for this task.

4fill in blank

hard

Fill both blanks to create a policy statement that grants read-only access to objects in a specific bucket.

AWS

{
  "Effect": "[1]",
  "Action": "[2]",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ]
}

Drag options to blanks, or click blank then click option'

ADeny

BAllow

Cs3:GetObject

D*

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Deny' instead of 'Allow' for the effect

Using overly broad actions like '*'

The 'Allow' effect with 's3:GetObject' action on the specified bucket and its objects grants read-only access, enforcing the principle of least privilege.

5fill in blank

hard

Fill all three blanks to create an IAM role trust policy allowing EC2 to assume the role.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "[1]",
      "Principal": {"Service": "[2]"},
      "Action": "[3]"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AAllow

Bec2.amazonaws.com

Csts:AssumeRole

Diam:PassRole

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Deny' instead of 'Allow' for effect

Using wrong service principal

Using 'iam:PassRole' instead of 'sts:AssumeRole'

The trust policy must allow EC2 service to assume the role using 'sts:AssumeRole' action with effect 'Allow'.