IAM best practices in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an IAM user with programmatic access.

AWS

aws iam create-user --user-name [1]

Drag options to blanks, or click blank then click option'

AAdminUser

BDefaultUser

CRootUser

DMyUser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'RootUser' as an IAM user name

Leaving the user name blank

The command creates an IAM user named 'MyUser'. Avoid using 'RootUser' as a user name because root access should be limited.

2fill in blank

medium

Complete the code to attach a policy that grants read-only access to S3.

AWS

aws iam attach-user-policy --user-name MyUser --policy-arn [1]

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::aws:policy/AmazonEC2FullAccess

Barn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Carn:aws:iam::aws:policy/AdministratorAccess

Darn:aws:iam::aws:policy/IAMFullAccess

Attempts:

3 left

💡 Hint

Common Mistakes

Using AdministratorAccess which grants too many permissions

Using policies unrelated to S3

The policy ARN 'AmazonS3ReadOnlyAccess' grants read-only permissions to S3 resources, following the principle of least privilege.

3fill in blank

hard

Fix the error in the policy JSON to allow only listing S3 buckets.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "[1]",
      "Resource": "*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

As3:DeleteBucket

Bs3:PutObject

Cs3:ListAllMyBuckets

Ds3:GetObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using actions that allow deleting or modifying buckets

Using object-level permissions instead of bucket-level

The action 's3:ListAllMyBuckets' allows listing all buckets in the account, which is the correct permission for this task.

4fill in blank

hard

Fill both blanks to create a policy statement that grants read-only access to objects in a specific bucket.

AWS

{
  "Effect": "[1]",
  "Action": "[2]",
  "Resource": [
    "arn:aws:s3:::example-bucket",
    "arn:aws:s3:::example-bucket/*"
  ]
}

Drag options to blanks, or click blank then click option'

ADeny

BAllow

Cs3:GetObject

D*

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Deny' instead of 'Allow' for the effect

Using overly broad actions like '*'

The 'Allow' effect with 's3:GetObject' action on the specified bucket and its objects grants read-only access, enforcing the principle of least privilege.

5fill in blank

hard

Fill all three blanks to create an IAM role trust policy allowing EC2 to assume the role.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "[1]",
      "Principal": {"Service": "[2]"},
      "Action": "[3]"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AAllow

Bec2.amazonaws.com

Csts:AssumeRole

Diam:PassRole

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Deny' instead of 'Allow' for effect

Using wrong service principal

Using 'iam:PassRole' instead of 'sts:AssumeRole'

The trust policy must allow EC2 service to assume the role using 'sts:AssumeRole' action with effect 'Allow'.

Practice

1. What is the main reason to follow the principle of least privilege in AWS IAM?

easy

A. To create permanent access keys for all users

B. To allow users full access to all AWS services

C. To give users only the permissions they need to do their job

D. To disable multi-factor authentication (MFA) for easier access

Solution

1. Step 1: Understand least privilege concept

   Least privilege means giving users only the permissions they need, nothing more.

2. Step 2: Identify correct option

   To give users only the permissions they need to do their job matches this concept by limiting permissions to what is necessary.

3. Final Answer:

   To give users only the permissions they need to do their job -> Option C

4. Quick Check:

   Least privilege = minimal permissions [OK]

Hint: Least privilege means minimal needed permissions only [OK]

Common Mistakes:

• Giving users full access unnecessarily
• Using permanent keys instead of temporary credentials
• Ignoring MFA setup

2. Which of the following is the correct way to assign permissions to an AWS service using IAM?

easy

A. Create an IAM role and assign it to the AWS service

B. Generate permanent access keys and embed them in the service code

C. Create an IAM user and attach policies directly to the user

D. Use root account credentials for the service

Solution

1. Step 1: Understand IAM roles for services

   IAM roles allow AWS services to assume permissions temporarily without permanent keys.

2. Step 2: Identify best practice

   Assigning an IAM role to the service is the recommended way to grant permissions securely.

3. Final Answer:

   Create an IAM role and assign it to the AWS service -> Option A

4. Quick Check:

   Use roles for services, not permanent keys [OK]

Hint: Use roles for AWS services, not permanent keys [OK]

Common Mistakes:

• Attaching policies directly to users for services
• Embedding permanent keys in code
• Using root account credentials

3. Consider this IAM policy snippet attached to a user:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:ListBucket"],
    "Resource": ["arn:aws:s3:::example-bucket"]
  }]
}

What can this user do?

medium

A. Upload files to example-bucket

B. List the contents of the example-bucket

C. Delete files from example-bucket

D. Access all S3 buckets

Solution

1. Step 1: Analyze the policy actions

   The policy allows only the "s3:ListBucket" action on the specific bucket resource.

2. Step 2: Determine allowed operations

   "s3:ListBucket" lets the user see the list of objects but not upload or delete.

3. Final Answer:

   List the contents of the example-bucket -> Option B

4. Quick Check:

   Action = s3:ListBucket means list only [OK]

Hint: Check the Action field to know allowed operations [OK]

Common Mistakes:

• Assuming upload or delete permissions from list permission
• Thinking the policy applies to all buckets
• Ignoring the specific resource ARN

4. You created an IAM user with full S3 access but forgot to enable MFA. What is the best way to fix this?

medium

A. Attach an MFA policy and require MFA for sensitive actions

B. Delete the user and create a new one with MFA enabled

C. Remove all permissions from the user

D. Share the root account credentials with the user

Solution

1. Step 1: Understand MFA enforcement

   MFA can be required by attaching policies that enforce MFA for sensitive actions.

2. Step 2: Apply best practice

   Attaching an MFA policy is better than deleting the user or removing permissions.

3. Final Answer:

   Attach an MFA policy and require MFA for sensitive actions -> Option A

4. Quick Check:

   Enable MFA via policy, don't delete users [OK]

Hint: Use policies to enforce MFA, not user deletion [OK]

Common Mistakes:

• Deleting users unnecessarily
• Removing all permissions without MFA
• Sharing root credentials

5. Your company wants to allow temporary access to AWS resources for contractors without creating permanent IAM users. Which approach follows best IAM practices?

hard

A. Give contractors permanent access keys with admin permissions

B. Create permanent IAM users with full access for contractors

C. Share your root account credentials with contractors

D. Create IAM roles with limited permissions and let contractors assume them

Solution

1. Step 1: Identify temporary access method

   IAM roles allow temporary credentials that contractors can assume without permanent users.

2. Step 2: Match best practice

   Creating roles with limited permissions follows least privilege and avoids permanent keys.

3. Final Answer:

   Create IAM roles with limited permissions and let contractors assume them -> Option D

4. Quick Check:

   Temporary roles for contractors = best practice [OK]

Hint: Use roles for temporary access, avoid permanent users [OK]

Common Mistakes:

• Creating permanent users for contractors
• Sharing root credentials
• Giving admin permissions unnecessarily