IAM users and groups in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an IAM user named 'Alice'.

AWS

aws iam create-user --user-name [1]

Drag options to blanks, or click blank then click option'

AAlice

BBob

CAdmin

DUser1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different user name than 'Alice'.

Leaving the user name blank.

The command creates an IAM user with the specified name. Here, 'Alice' is the correct user name.

2fill in blank

medium

Complete the code to add the user 'Alice' to the group named 'Developers'.

AWS

aws iam add-user-to-group --group-name [1] --user-name Alice

Drag options to blanks, or click blank then click option'

AManagers

BAdmins

CUsers

DDevelopers

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong group name.

Swapping user and group names.

This command adds the user 'Alice' to the group 'Developers'. The group name must match exactly.

3fill in blank

hard

Fix the error in the command to list all users in the group 'Admins'.

AWS

aws iam get-group --group-name [1]

Drag options to blanks, or click blank then click option'

AUsers

BManagers

CAdmins

DDevelopers

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong group name.

Using a command other than 'get-group'.

The command 'aws iam get-group' lists users in the specified group. The group name must be 'Admins' to list its users.

4fill in blank

hard

Fill both blanks to create a group named 'Testers' and attach the policy 'AmazonS3ReadOnlyAccess' to it.

AWS

aws iam create-group --group-name [1]
aws iam attach-group-policy --group-name [2] --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Drag options to blanks, or click blank then click option'

ATesters

BAdmins

CDevelopers

DUsers

Attempts:

3 left

💡 Hint

Common Mistakes

Using different group names in the two commands.

Using a group name other than 'Testers'.

Both commands use the group name 'Testers' to create the group and attach the policy to it.

5fill in blank

hard

Fill all three blanks to create a user 'Bob', add him to the group 'Admins', and then delete the user.

AWS

aws iam create-user --user-name [1]
aws iam add-user-to-group --group-name [2] --user-name [3]
aws iam delete-user --user-name Bob

Drag options to blanks, or click blank then click option'

AAlice

BAdmins

CBob

DDevelopers

Attempts:

3 left

💡 Hint

Common Mistakes

Using different user names in create and add commands.

Using wrong group name.

Not matching the user name in delete command.

The user created is 'Bob', who is added to the 'Admins' group, and then the user 'Bob' is deleted.

Practice

1. What is the main purpose of an IAM group in AWS?

easy

A. To organize multiple IAM users and assign permissions collectively

B. To store data securely in the cloud

C. To create virtual servers for applications

D. To monitor network traffic in AWS

Solution

1. Step 1: Understand IAM user and group roles

   IAM users represent individuals or services, while groups organize these users.

2. Step 2: Identify the purpose of groups

   Groups allow assigning permissions to many users at once, simplifying management.

3. Final Answer:

   To organize multiple IAM users and assign permissions collectively -> Option A

4. Quick Check:

   IAM groups = organize users + assign permissions [OK]

Hint: Groups bundle users for easy permission management [OK]

Common Mistakes:

• Confusing groups with storage or servers
• Thinking groups monitor network traffic
• Believing groups are individual user accounts

2. Which of the following is the correct way to add an IAM user named alice to a group named Developers using AWS CLI?

easy

A. aws iam add-group-to-user --group-name Developers --user-name alice

B. aws iam attach-user-policy --user-name alice --policy-name Developers

C. aws iam add-user-to-group --user-name alice --group-name Developers

D. aws iam create-group --group-name Developers --user alice

Solution

1. Step 1: Recall AWS CLI command for adding user to group

   The correct command is aws iam add-user-to-group with parameters --user-name and --group-name.

2. Step 2: Match command syntax with options

   aws iam add-user-to-group --user-name alice --group-name Developers matches the correct syntax exactly.

3. Final Answer:

   aws iam add-user-to-group --user-name alice --group-name Developers -> Option C

4. Quick Check:

   Correct CLI command = aws iam add-user-to-group --user-name alice --group-name Developers [OK]

Hint: Use 'add-user-to-group' command with user and group names [OK]

Common Mistakes:

• Using 'attach-user-policy' instead of adding to group
• Confusing 'create-group' with adding users
• Reversing user and group parameters

3. Given the following IAM group policy attached to group Admins:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "*"
  }]
}

If user bob is added to the Admins group, what permissions does bob have on S3?

medium

A. Full access to all S3 actions and resources

B. Read-only access to S3 buckets

C. No access to S3 unless user policy allows it

D. Access only to S3 buckets created by bob

Solution

1. Step 1: Analyze the group policy permissions

   The policy allows all S3 actions (s3:*) on all resources (*), meaning full access.

2. Step 2: Understand group membership effect

   User bob inherits all permissions from the Admins group.

3. Final Answer:

   Full access to all S3 actions and resources -> Option A

4. Quick Check:

   Group policy allows s3:* on * = full access [OK]

Hint: s3:* on * means full S3 access [OK]

Common Mistakes:

• Assuming user needs separate policy for access
• Thinking group policies restrict to created buckets
• Confusing read-only with full access

4. You tried to add user carol to group Managers using this command:

aws iam add-user-to-group --group-name Managers --user carol

But it failed. What is the error in this command?

medium

A. The command should be 'aws iam add-group-to-user' instead

B. The parameter should be --user-name, not --user

C. The group name should be specified after --user-name

D. The user name must be in quotes

Solution

1. Step 1: Check AWS CLI command syntax

   The correct parameter for specifying the user is --user-name, not --user.

2. Step 2: Identify the error in the command

   Using --user causes the command to fail because it is invalid.

3. Final Answer:

   The parameter should be --user-name, not --user -> Option B

4. Quick Check:

   Correct parameter = --user-name [OK]

Hint: Use --user-name, not --user, for specifying IAM user [OK]

Common Mistakes:

• Using incorrect parameter names
• Swapping user and group parameters
• Adding unnecessary quotes around names

5. You want to create a secure setup where users in the Developers group can only start and stop EC2 instances, but not terminate them. Which IAM policy snippet attached to the group achieves this?

hard

A. {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances"],
"Resource": "*"
}]
}

B. {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
}]
}

C. {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "ec2:TerminateInstances",
"Resource": "*"
}]
}

D. {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["ec2:StartInstances", "ec2:StopInstances"],
"Resource": "*"
}]
}

Solution

1. Step 1: Understand required permissions

   Users should only start and stop instances, so allow only those actions.

2. Step 2: Evaluate policy options

   { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["ec2:StartInstances", "ec2:StopInstances"], "Resource": "*" }] } allows only StartInstances and StopInstances. { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": "ec2:*", "Resource": "*" }] } allows all EC2 actions, including terminate. { "Version": "2012-10-17", "Statement": [{ "Effect": "Deny", "Action": "ec2:TerminateInstances", "Resource": "*" }] } denies terminate but does not allow start/stop explicitly. { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["ec2:StartInstances", "ec2:StopInstances", "ec2:TerminateInstances"], "Resource": "*" }] } allows terminate, which is not desired.

3. Final Answer:

   Policy allowing only start and stop EC2 instances -> Option D

4. Quick Check:

   Allow only start/stop, no terminate = { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": ["ec2:StartInstances", "ec2:StopInstances"], "Resource": "*" }] } [OK]

Hint: Allow only needed actions, avoid wildcard ec2:* [OK]

Common Mistakes:

• Using ec2:* allows unwanted terminate action
• Only denying terminate without allowing start/stop
• Including terminate in allowed actions