IAM roles concept in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding IAM Role Trust Policies

Which statement best describes the purpose of the trust policy in an AWS IAM role?

A It defines which AWS services or users can assume the role.

B It specifies the permissions granted to the role for accessing AWS resources.

C It encrypts the role's credentials to enhance security.

D It logs all actions performed by the role for auditing.

💡 Hint

Think about who is allowed to use the role, not what the role can do.

The trust policy defines the entities (users, services, accounts) that are allowed to assume the IAM role. Permissions granted to the role are defined separately in permission policies.

❓ service_behavior

intermediate

Role Assumption Behavior

What happens when an AWS Lambda function assumes an IAM role with limited permissions?

A The Lambda function can perform any action in AWS regardless of the role's permissions.

B The Lambda function ignores the role's permissions and uses the account root permissions.

C The Lambda function can perform only the actions allowed by the role's permissions.

D The Lambda function cannot access AWS resources unless explicitly granted permissions in its code.

💡 Hint

Consider how roles limit what a service can do.

When a Lambda function assumes an IAM role, it inherits only the permissions granted by that role. It cannot exceed those permissions.

❓ Architecture

advanced

Cross-Account Access Using IAM Roles

You want an EC2 instance in Account A to access an S3 bucket in Account B securely. Which setup correctly enables this using IAM roles?

A Create an IAM role in Account A with permissions to access the S3 bucket in Account B without any trust policy in Account B.

B Create an IAM role in Account B with permissions to access the S3 bucket and a trust policy allowing Account A's EC2 instance to assume it. Then configure the EC2 instance to assume this role.

C Create an IAM user in Account B with S3 access and share its access keys with the EC2 instance in Account A.

D Attach an IAM role with S3 access directly to the EC2 instance in Account A without any trust policy changes.

💡 Hint

Think about how trust policies enable cross-account role assumption.

Cross-account access requires a role in the target account (Account B) with a trust policy that allows the source account (Account A) to assume it. Sharing access keys or roles without trust policies does not work securely.

❓ security

advanced

Least Privilege Principle with IAM Roles

You have an IAM role used by an application that only needs to read data from DynamoDB. Which policy best follows the least privilege principle?

A A policy granting only the dynamodb:GetItem and dynamodb:Query actions on the specific DynamoDB table.

B A policy granting full access to all DynamoDB actions on all tables.

C A policy granting read and write permissions on all DynamoDB tables.

D A policy granting only the dynamodb:Scan action on all DynamoDB tables.

💡 Hint

Least privilege means giving only the exact permissions needed.

Granting only the necessary read actions on the specific table limits risk and follows best security practices.

✅ Best Practice

expert

Automating Temporary Credentials with IAM Roles

You want to automate a process that runs on an on-premises server and needs temporary AWS credentials with limited permissions. Which approach follows AWS best practices?

A Use the root account credentials to authenticate the on-premises server for full access.

B Create an IAM user with long-term access keys and embed them in the on-premises server configuration.

C Manually generate IAM user credentials daily and update the on-premises server configuration.

D Use AWS Security Token Service (STS) to assume an IAM role with limited permissions and retrieve temporary credentials programmatically.

💡 Hint

Think about temporary credentials and automation without long-term keys.

Using STS to assume roles and get temporary credentials is secure and avoids long-term keys on servers.