IAM policies (JSON structure) in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the effect of this IAM policy snippet?

Given this IAM policy snippet, what will be the effect on the user permissions?

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:DeleteBucket",
      "Resource": "arn:aws:s3:::example-bucket"
    }
  ]
}

A The user is explicitly denied permission to delete the bucket named 'example-bucket'.

B The user can delete the bucket named 'example-bucket'.

C The user can perform any action on 'example-bucket' except deleting objects inside it.

D The user is denied all actions on 'example-bucket'.

💡 Hint

Look at the Effect and Action fields carefully.

The policy explicitly denies the 's3:DeleteBucket' action on the specified bucket. Other actions are not denied.

❓ Configuration

intermediate

Which IAM policy allows listing all S3 buckets?

Select the IAM policy that correctly allows a user to list all S3 buckets in the account.

A

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:ListBucket",
    "Resource": "*"
  }]
}

B

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:ListBucket",
    "Resource": "arn:aws:s3:::*"
  }]
}

C

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:ListAllMyBuckets",
    "Resource": "*"
  }]
}

D

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:ListAllBuckets",
    "Resource": "*"
  }]
}

💡 Hint

The action name must be exact and the resource for listing all buckets is special.

The correct action to list all buckets is 's3:ListAllMyBuckets' and it requires resource '*'.

❓ Architecture

advanced

Which IAM policy structure correctly restricts access to a specific DynamoDB table?

You want to allow a user to only read items from a DynamoDB table named 'Orders'. Which policy snippet correctly restricts access?

A

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan"],
    "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
  }]
}

B

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "dynamodb:*",
    "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
  }]
}

C

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["dynamodb:GetItem", "dynamodb:Query"],
    "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/*"
  }]
}

D

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan"],
    "Resource": "*"
  }]
}

💡 Hint

Restrict the resource ARN to the exact table and limit actions to read-only.

Option A allows only read actions on the specific 'Orders' table ARN, restricting access properly.

❓ security

advanced

What error occurs if an IAM policy JSON misses a comma between statements?

Consider this IAM policy JSON snippet missing a comma between two statements. What error will AWS IAM report when you try to apply it?

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

A Policy applies but only the first statement works.

B AccessDenied error when applying the policy.

C No error; AWS IAM auto-corrects the JSON.

D Syntax error: Missing comma between JSON objects in the Statement array.

💡 Hint

JSON syntax requires commas between objects in arrays.

The missing comma causes a JSON syntax error, so AWS IAM rejects the policy.

🧠 Conceptual

expert

What is the final permission effect when multiple IAM policies conflict?

A user has two IAM policies attached: one explicitly allows 'ec2:StartInstances' and another explicitly denies 'ec2:StartInstances'. What is the final permission effect when the user tries to start an EC2 instance?

A The user is allowed to start the EC2 instance because Allow overrides Deny.

B The user is denied permission because explicit Deny overrides Allow.

C The user is allowed only if the Allow policy has higher priority.

D The user is denied only if the Deny policy is attached directly to the user.

💡 Hint

Explicit Deny always takes precedence over Allow in IAM.

In AWS IAM, explicit Deny always overrides any Allow, regardless of policy attachment or priority.