IAM policies (JSON structure) in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the version of the IAM policy.

AWS

{
  "Version": "[1]",
  "Statement": []
}

Drag options to blanks, or click blank then click option'

A2020-01-01

B2012-10-17

C2015-05-20

D2010-09-09

Attempts:

3 left

💡 Hint

Common Mistakes

Using an incorrect or unsupported version date.

Leaving the version field empty.

The correct version for IAM policies is 2012-10-17. This version supports all current features.

2fill in blank

medium

Complete the code to specify the effect of the IAM policy statement.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "[1]",
      "Action": "s3:ListBucket",
      "Resource": "*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

ABlock

BDeny

CPermit

DAllow

Attempts:

3 left

💡 Hint

Common Mistakes

Using words like 'Permit' or 'Block' which are not valid in IAM policies.

Leaving the Effect field blank.

The Effect field must be either Allow or Deny. Here, Allow grants permission.

3fill in blank

hard

Fix the error in the action name to correctly specify S3 bucket listing.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "[1]",
      "Resource": "*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

As3:ListAllBuckets

Bs3:ListBuckets

Cs3:ListBucket

Ds3:ListBucketObjects

Attempts:

3 left

💡 Hint

Common Mistakes

Using plural forms like 'ListBuckets' which do not exist.

Adding extra words to the action name.

The correct action to list objects in a bucket is s3:ListBucket. Other options are invalid.

4fill in blank

hard

Fill both blanks to specify a policy statement that denies deleting objects from a specific bucket.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "[1]",
      "Action": "[2]",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

ADeny

BAllow

Cs3:DeleteObject

Ds3:PutObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Allow' instead of 'Deny' for blocking actions.

Choosing the wrong action like 's3:PutObject'.

To deny deleting objects, the Effect must be Deny and the Action must be s3:DeleteObject.

5fill in blank

hard

Fill all three blanks to create a policy statement that allows reading objects from a bucket only if the request comes from a specific IP address.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "[1]",
      "Action": "[2]",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "[3]"
        }
      }
    }
  ]
}

Drag options to blanks, or click blank then click option'

AAllow

Bs3:GetObject

C203.0.113.0/24

DDeny

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Deny' instead of 'Allow' for granting access.

Choosing the wrong action like 's3:PutObject'.

Incorrect IP address format.

The policy allows (Allow) the action s3:GetObject only if the request comes from the IP range 203.0.113.0/24.