Policy evaluation logic in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the effect that allows access in an IAM policy statement.

AWS

{
  "Effect": "[1]",
  "Action": "s3:ListBucket",
  "Resource": "arn:aws:s3:::example_bucket"
}

Drag options to blanks, or click blank then click option'

AAllow

BDeny

CPermit

DBlock

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Deny' when you want to allow access

Using unsupported values like 'Permit' or 'Block'

The Effect field in an IAM policy must be either Allow or Deny. To grant access, use Allow.

2fill in blank

medium

Complete the code to specify the action that allows reading objects from an S3 bucket.

AWS

{
  "Effect": "Allow",
  "Action": "[1]",
  "Resource": "arn:aws:s3:::example_bucket/*"
}

Drag options to blanks, or click blank then click option'

As3:GetObject

Bs3:PutObject

Cs3:DeleteObject

Ds3:ListBucket

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'PutObject' which is for writing

Using 'ListBucket' which lists bucket contents but not object read

The s3:GetObject action allows reading objects from an S3 bucket.

3fill in blank

hard

Fix the error in the policy statement by completing the missing resource ARN for an S3 bucket.

AWS

{
  "Effect": "Allow",
  "Action": "s3:ListBucket",
  "Resource": "[1]"
}

Drag options to blanks, or click blank then click option'

Aarn:aws:s3:::example_bucket/object

Barn:aws:s3:::example_bucket/*

Carn:aws:s3:::example_bucket

Darn:aws:s3:::*

Attempts:

3 left

💡 Hint

Common Mistakes

Using the ARN with '/*' which is for objects, not buckets

Using a wildcard ARN that is too broad

The s3:ListBucket action requires the bucket ARN without the trailing slash or wildcard.

4fill in blank

hard

Fill both blanks to complete the condition that allows access only if the request comes from a specific IP address.

AWS

{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "arn:aws:s3:::example_bucket/*",
  "Condition": {
    "IpAddress": {
      "aws:SourceIp": "[1]"
    },
    "Bool": {
      "aws:SecureTransport": "[2]"
    }
  }
}

Drag options to blanks, or click blank then click option'

A203.0.113.0/24

Btrue

Cfalse

D192.168.1.1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a single IP instead of a CIDR block when a range is intended

Setting 'aws:SecureTransport' to 'false' which disables HTTPS enforcement

The IpAddress condition restricts access to the specified IP range. The aws:SecureTransport condition set to true requires HTTPS.

5fill in blank

hard

Fill all three blanks to complete the policy statement that denies all actions except listing the bucket and getting objects.

AWS

{
  "Effect": "[1]",
  "NotAction": ["[2]", "[3]"],
  "Resource": "arn:aws:s3:::example_bucket/*"
}

Drag options to blanks, or click blank then click option'

ADeny

Bs3:ListBucket

Cs3:GetObject

DAllow

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Allow' instead of 'Deny' for the effect

Listing wrong actions in 'NotAction'

The Effect is set to Deny to block all actions except those listed in NotAction. Here, listing the bucket and getting objects are allowed.