Least privilege principle in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ security

intermediate

Identify the IAM policy that follows least privilege

Which IAM policy grants the least privilege necessary for a Lambda function to read items from a specific DynamoDB table?

A {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["dynamodb:DeleteItem"], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

B {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "dynamodb:*", "Resource": "*"}]}

C {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["dynamodb:GetItem", "dynamodb:Query"], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

D {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["dynamodb:GetItem"], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

💡 Hint

Focus on granting only the actions needed and restrict the resource to the specific table.

Option C grants only the read actions (GetItem, Query) on the specific DynamoDB table, following least privilege. Option C grants all actions on all resources, which is excessive. Option C grants only DeleteItem, which is not needed. Option C restricts actions but allows access to all tables, which is broader than necessary.

✅ Best Practice

intermediate

Choosing the right IAM role for EC2 instance access

You want an EC2 instance to upload files only to a specific S3 bucket. Which IAM role policy follows the least privilege principle?

A {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::my-app-uploads/*"}]}

B {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::*"}]}

C {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::my-app-uploads"}]}

D {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-app-uploads/*"}]}

💡 Hint

Allow only the action needed to upload files and restrict to the specific bucket path.

Option A allows only the PutObject action on the specific bucket path, which is exactly what is needed. Option A allows all S3 actions on all buckets, which is too broad. Option A allows only listing the bucket, which does not permit uploading. Option A allows only reading objects, which is not the required permission.

❓ Architecture

advanced

Designing a multi-tier app with least privilege access

You have a web app with three tiers: frontend, backend, and database. Which architecture best applies the least privilege principle for AWS IAM roles?

A Assign separate IAM roles: frontend role with no AWS permissions, backend role with DynamoDB read/write, database role with RDS access only.

B Assign one IAM role to all tiers with full access to S3, DynamoDB, and RDS.

C Assign one IAM role to frontend and backend with full S3 access, and a separate role for database with RDS access.

D Assign backend role with full access to all AWS services, frontend role with read-only S3 access, database role with no permissions.

💡 Hint

Think about limiting permissions to only what each tier needs.

Option A assigns roles with permissions strictly needed by each tier: frontend has no AWS permissions, backend accesses DynamoDB, database accesses RDS. This follows least privilege. Option A grants all permissions to all tiers, which is excessive. Option A grants full S3 access to frontend and backend unnecessarily. Option A grants backend full AWS access, which is too broad.

❓ service_behavior

advanced

Effect of overly broad IAM permissions on AWS Lambda behavior

You deploy a Lambda function with an IAM role that has full access to all S3 buckets. What is the likely impact compared to a role with access only to one bucket?

A The Lambda function will only access the specified bucket regardless of permissions.

B The Lambda function can access all buckets, increasing risk if compromised.

C The Lambda function will fail to execute due to too many permissions.

D The Lambda function will run faster with broader permissions.

💡 Hint

Consider security risks of broad permissions.

Option B is correct because broad permissions allow the function to access all buckets, which increases risk if the function is compromised. Option B is false; permissions define what is allowed, not what is used. Option B is incorrect; too many permissions do not cause failure. Option B is false; permissions do not affect execution speed.

🧠 Conceptual

expert

Identifying violation of least privilege in a cross-account access scenario

An AWS account A grants an IAM role in account B permission to assume it and access all S3 buckets in account A. Which statement best describes the least privilege violation?

A Account B should not assume any roles in account A to maintain security.

B Account B should have full access to all resources in account A for flexibility.

C Account A should allow the role to assume any IAM role in account B.

D Account A should restrict the role's permissions to only required buckets instead of all buckets.

💡 Hint

Focus on limiting permissions granted across accounts.

Option D correctly identifies that granting access to all S3 buckets violates least privilege; permissions should be limited to only necessary buckets. Option D is insecure and violates least privilege. Option D is unrelated and insecure. Option D is too restrictive and may not meet business needs.