Managed vs inline policies in AWS - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to attach a managed policy to an IAM user.

AWS

aws iam attach-user-policy --user-name MyUser --policy-arn [1]

Drag options to blanks, or click blank then click option'

AMyInlinePolicy

Barn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Carn:aws:iam::123456789012:policy/CustomPolicy

DMyUserPolicy

Attempts:

3 left

💡 Hint

Common Mistakes

Using the policy name instead of the ARN for managed policies.

Confusing inline policy names with managed policy ARNs.

Managed policies are referenced by their ARN. Inline policies are embedded directly and do not use ARNs.

2fill in blank

medium

Complete the code to create an inline policy for an IAM role.

AWS

aws iam put-role-policy --role-name MyRole --policy-name [1] --policy-document file://policy.json

Drag options to blanks, or click blank then click option'

AMyInlinePolicy

Barn:aws:iam::aws:policy/AdministratorAccess

CMyRolePolicyArn

Darn:aws:iam::123456789012:policy/CustomPolicy

Attempts:

3 left

💡 Hint

Common Mistakes

Using ARNs instead of policy names for inline policies.

Confusing managed policy ARNs with inline policy names.

Inline policies require a policy name, not an ARN.

3fill in blank

hard

Fix the error in the command to detach a managed policy from a user.

AWS

aws iam detach-user-policy --user-name MyUser --policy-arn [1]

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess

BMyUserPolicy

Carn:aws:iam::123456789012:policy/CustomPolicy

DMyInlinePolicy

Attempts:

3 left

💡 Hint

Common Mistakes

Using inline policy names instead of ARNs.

Trying to detach inline policies with this command.

Detaching a managed policy requires the full ARN of the managed policy.

4fill in blank

hard

Fill both blanks to create and attach an inline policy to a user.

AWS

aws iam put-user-policy --user-name MyUser --policy-name [1] --policy-document [2]

Drag options to blanks, or click blank then click option'

AMyInlinePolicy

Bfile://policy.json

Carn:aws:iam::aws:policy/ReadOnlyAccess

DMyManagedPolicy

Attempts:

3 left

💡 Hint

Common Mistakes

Using managed policy ARNs instead of a policy name.

Not specifying the policy document correctly.

Inline policies require a policy name and a policy document file path.

5fill in blank

hard

Fill all three blanks to list all managed policies and filter by scope.

AWS

aws iam list-policies --scope [1] --only-attached [2] --max-items [3]

Drag options to blanks, or click blank then click option'

ALocal

Btrue

C10

DAWS

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Local' instead of 'AWS' for scope.

Omitting the '--only-attached' flag or using incorrect values.

Not setting 'max-items' or using non-numeric values.

To list AWS managed policies, use scope 'AWS'. The flag '--only-attached' expects 'true' or 'false'. 'max-items' limits the number of results.

Practice

1. Which statement best describes an AWS managed policy?

easy

A. A policy that cannot be changed once created.

B. A policy embedded directly into a single user, group, or role.

C. A reusable permission set that can be attached to multiple users, groups, or roles.

D. A policy that only applies to AWS services, not users.

Solution

1. Step 1: Understand managed policy characteristics

   Managed policies are standalone and reusable permission sets in AWS.

2. Step 2: Compare with inline policies

   Inline policies are embedded directly into one user, group, or role, unlike managed policies.

3. Final Answer:

   A reusable permission set that can be attached to multiple users, groups, or roles. -> Option C

4. Quick Check:

   Managed policy = reusable permission set [OK]

Hint: Managed = reusable; Inline = embedded [OK]

Common Mistakes:

• Confusing inline policies as reusable
• Thinking managed policies are fixed and unchangeable
• Assuming managed policies apply only to services

2. Which of the following is the correct way to attach an inline policy to a user in AWS IAM?

easy

A. AttachPolicy(userName, policyArn)

B. PutUserPolicy(userName, policyName, policyDocument)

C. AttachUserPolicy(userName, policyName)

D. CreateInlinePolicy(policyDocument)

Solution

1. Step 1: Identify AWS IAM API for inline policies

   The correct API to attach an inline policy to a user is PutUserPolicy, which requires user name, policy name, and policy document.

2. Step 2: Eliminate incorrect options

   AttachPolicy and AttachUserPolicy are not valid AWS IAM API calls for inline policies. CreateInlinePolicy is not a valid standalone call.

3. Final Answer:

   PutUserPolicy(userName, policyName, policyDocument) -> Option B

4. Quick Check:

   Inline policy attachment uses PutUserPolicy [OK]

Hint: Inline policies use PutUserPolicy API [OK]

Common Mistakes:

• Using AttachPolicy which is for managed policies
• Confusing policy ARN with inline policy document
• Trying to create inline policy without specifying user

3. Given the following scenario: A user has both an inline policy allowing S3 read access and a managed policy denying S3 access. What is the effective permission for S3 access?

medium

A. The user cannot read S3 because explicit deny in managed policy overrides allow.

B. The user cannot read S3 because inline policies are ignored when managed policies exist.

C. The user can read S3 because managed policies are ignored if inline policies exist.

D. The user can read S3 because inline policies override managed policies.

Solution

1. Step 1: Understand AWS policy evaluation logic

   AWS evaluates all policies together. Explicit deny in any policy overrides any allow.

2. Step 2: Apply to scenario

   The managed policy denies S3 access explicitly, so even though inline policy allows it, deny takes precedence.

3. Final Answer:

   The user cannot read S3 because explicit deny in managed policy overrides allow. -> Option A

4. Quick Check:

   Explicit deny always overrides allow [OK]

Hint: Explicit deny beats allow, regardless of policy type [OK]

Common Mistakes:

• Thinking inline policies override managed policies
• Assuming allow always wins
• Ignoring explicit deny rules

4. You created an inline policy for a role but it is not granting the expected permissions. What is the most likely cause?

medium

A. The inline policy JSON syntax is invalid.

B. The role already has a managed policy attached with higher priority.

C. Inline policies cannot be attached to roles.

D. The inline policy name conflicts with an existing managed policy.

Solution

1. Step 1: Verify inline policy attachment rules

   Inline policies can be attached to roles, so Inline policies cannot be attached to roles. is incorrect.

2. Step 2: Check common issues with inline policies

   Invalid JSON syntax in the inline policy will prevent permissions from applying correctly.

3. Step 3: Understand policy priority

   Managed and inline policies are evaluated together; no priority overrides permissions except explicit deny.

4. Final Answer:

   The inline policy JSON syntax is invalid. -> Option A

5. Quick Check:

   Invalid JSON breaks policy effect [OK]

Hint: Check JSON syntax first for inline policy issues [OK]

Common Mistakes:

• Assuming inline policies can't attach to roles
• Thinking managed policies override inline by priority
• Confusing policy names causing conflicts

5. You manage a team where multiple users need the same permissions to access DynamoDB. You also have one user who needs a unique permission set. What is the best approach to assign policies?

hard

A. Use only managed policies for all users, including the unique one.

B. Create inline policies for all users to keep permissions separate.

C. Attach the same inline policy to all users and add extra inline policies for the unique user.

D. Create a managed policy for the common permissions and attach it to all users; create an inline policy for the unique user.

Solution

1. Step 1: Identify best practice for shared permissions

   Managed policies are reusable and ideal for common permissions shared by multiple users.

2. Step 2: Handle unique permissions

   Inline policies are best for unique, one-off permissions tied to a single user.

3. Step 3: Combine approaches for efficiency and clarity

   Use managed policy for the team and inline policy for the unique user to avoid duplication and ease management.

4. Final Answer:

   Create a managed policy for the common permissions and attach it to all users; create an inline policy for the unique user. -> Option D

5. Quick Check:

   Managed for shared, inline for unique [OK]

Hint: Managed for many users, inline for one user [OK]

Common Mistakes:

• Using inline policies for all users causing duplication
• Using only managed policies losing unique control
• Attaching same inline policy to multiple users