Least privilege principle in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the minimum permission needed to allow reading objects from an S3 bucket.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:[1]",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

APutObject

BListBucket

CDeleteObject

DGetObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using PutObject which allows writing instead of reading.

Using DeleteObject which allows deleting objects.

Using ListBucket which allows listing bucket contents but not reading objects.

The GetObject action allows reading objects from an S3 bucket, which follows the least privilege principle by granting only read access.

2fill in blank

medium

Complete the code to restrict an IAM user to only start EC2 instances.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:[1]",
      "Resource": "*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AStartInstances

BStopInstances

CTerminateInstances

DRebootInstances

Attempts:

3 left

💡 Hint

Common Mistakes

Using StopInstances which stops instances instead of starting.

Using TerminateInstances which deletes instances.

Using RebootInstances which restarts instances.

The StartInstances action allows the user to start EC2 instances only, following the least privilege principle.

3fill in blank

hard

Fix the error in the policy to allow only listing the contents of a specific S3 bucket.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:[1]",
      "Resource": "arn:aws:s3:::my-bucket"
    }
  ]
}

Drag options to blanks, or click blank then click option'

ADeleteBucket

BGetObject

CListBucket

DPutObject

Attempts:

3 left

💡 Hint

Common Mistakes

Using GetObject which requires object ARN, not bucket ARN.

Using PutObject which allows writing objects.

Using DeleteBucket which deletes the bucket.

The ListBucket action allows listing the contents of the bucket itself, which requires the bucket ARN without the trailing /*.

4fill in blank

hard

Fill both blanks to create a policy that allows reading objects only from a specific folder inside an S3 bucket.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:[1]",
      "Resource": "arn:aws:s3:::example-bucket/[2]/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AGetObject

BListBucket

Clogs

Dimages

Attempts:

3 left

💡 Hint

Common Mistakes

Using ListBucket which does not allow reading objects.

Using wrong folder names that do not match the resource path.

The GetObject action allows reading objects, and specifying the folder 'logs' restricts access to that folder only.

5fill in blank

hard

Fill all three blanks to create a policy that allows an IAM user to start and stop EC2 instances only in a specific region.

AWS

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["ec2:[1]", "ec2:[2]"],
      "Resource": "arn:aws:ec2:[3]:*:instance/*"
    }
  ]
}

Drag options to blanks, or click blank then click option'

AStartInstances

BStopInstances

Cus-west-2

DTerminateInstances

Attempts:

3 left

💡 Hint

Common Mistakes

Using TerminateInstances which deletes instances.

Using incorrect region codes or omitting the region.

Using actions unrelated to starting or stopping instances.

The actions StartInstances and StopInstances allow starting and stopping EC2 instances. Specifying the region us-west-2 restricts the policy to that region.