IAM roles concept in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the AWS service that assumes the IAM role.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "[1]"},
      "Action": "sts:AssumeRole"
    }
  ]
}

Drag options to blanks, or click blank then click option'

Aec2.amazonaws.com

Blambda.amazonaws.com

Cs3.amazonaws.com

Ddynamodb.amazonaws.com

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing EC2 service when the role is for Lambda.

Using S3 or DynamoDB as the principal service.

The Principal specifies which AWS service can assume the role. For AWS Lambda functions, it is lambda.amazonaws.com.

2fill in blank

medium

Complete the code to allow the role to perform the action of reading objects from S3.

AWS

{
  "Effect": "Allow",
  "Action": "s3:[1]",
  "Resource": "arn:aws:s3:::example-bucket/*"
}

Drag options to blanks, or click blank then click option'

AGetObject

BPutObject

CDeleteObject

DListBucket

Attempts:

3 left

💡 Hint

Common Mistakes

Using PutObject which is for uploading files.

Using ListBucket which is for listing bucket contents.

The GetObject action allows reading objects from an S3 bucket.

3fill in blank

hard

Fix the error in the trust policy by completing the missing action that allows role assumption.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "ecs-tasks.amazonaws.com"},
      "Action": "sts:[1]"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AAssumeRole

BPassRole

CGetRole

DCreateRole

Attempts:

3 left

💡 Hint

Common Mistakes

Using GetRole which only retrieves role details.

Using PassRole which is for passing roles to services.

The action sts:AssumeRole is required in the trust policy to allow the specified service to assume the role.

4fill in blank

hard

Fill both blanks to create a policy statement that allows listing all S3 buckets and reading objects from a specific bucket.

AWS

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:[1]", "s3:[2]"],
      "Resource": ["arn:aws:s3:::*", "arn:aws:s3:::example-bucket/*"]
    }
  ]
}

Drag options to blanks, or click blank then click option'

AListBucket

BGetObject

CPutObject

DDeleteBucket

Attempts:

3 left

💡 Hint

Common Mistakes

Using PutObject which is for uploading files.

Using DeleteBucket which is for deleting buckets.

ListBucket allows listing all buckets, and GetObject allows reading objects from the specified bucket.

5fill in blank

hard

Fill all three blanks to define a role trust policy that allows EC2 instances to assume the role with the correct action and service.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "[1]",
      "Principal": {"Service": "[2]"},
      "Action": "sts:[3]"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AAllow

Bec2.amazonaws.com

CAssumeRole

DDeny

Attempts:

3 left

💡 Hint

Common Mistakes

Using Deny as the effect.

Using the wrong service name.

Using incorrect STS action.

The trust policy must Allow the ec2.amazonaws.com service to perform the sts:AssumeRole action to assume the role.