Why IAM is foundational in AWS - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an IAM user named 'Alice'.

AWS

aws iam create-user --user-name [1]

Drag options to blanks, or click blank then click option'

AAdmin

BAlice

CRoot

DGuest

Attempts:

3 left

💡 Hint

Common Mistakes

Using role names instead of user names.

Using reserved names like 'Root'.

The command creates an IAM user named 'Alice'. This is the correct user name for this example.

2fill in blank

medium

Complete the code to attach the 'ReadOnlyAccess' policy to the IAM user.

AWS

aws iam attach-user-policy --user-name Alice --policy-arn [1]

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::aws:policy/ReadOnlyAccess

Barn:aws:iam::aws:policy/AdministratorAccess

Carn:aws:iam::aws:policy/PowerUserAccess

Darn:aws:iam::aws:policy/IAMFullAccess

Attempts:

3 left

💡 Hint

Common Mistakes

Using the AdministratorAccess policy ARN instead of ReadOnlyAccess.

Confusing policy ARNs.

The 'ReadOnlyAccess' policy ARN is used to give read-only permissions to the user.

3fill in blank

hard

Fix the error in the command to list all IAM users.

AWS

aws iam [1]-users

Drag options to blanks, or click blank then click option'

Ashow

Bdescribe

Cget

Dlist

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'show-users' or 'get-users' which are invalid commands.

Confusing AWS CLI verbs.

The correct AWS CLI command to list IAM users is 'aws iam list-users'.

4fill in blank

hard

Fill both blanks to create a policy document that allows listing S3 buckets.

AWS

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "[1]",
    "Resource": "[2]"
  }]
}

Drag options to blanks, or click blank then click option'

As3:ListAllMyBuckets

Barn:aws:s3:::*

Cs3:PutObject

Darn:aws:s3:::example-bucket/*

Attempts:

3 left

💡 Hint

Common Mistakes

Using write actions like 's3:PutObject' instead of list actions.

Restricting resource to a single bucket instead of all buckets.

The action 's3:ListAllMyBuckets' allows listing all buckets, and the resource 'arn:aws:s3:::*' applies to all buckets.

5fill in blank

hard

Fill all three blanks to create an IAM role trust policy allowing EC2 to assume the role.

AWS

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "[1]"},
    "Action": "[2]",
    "Condition": {"ArnLike": {"[3]": "arn:aws:ec2:*:*:instance/*"}}
  }]
}

Drag options to blanks, or click blank then click option'

Aec2.amazonaws.com

Bsts:AssumeRole

Caws:SourceArn

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong service principal names.

Using incorrect action names.

Confusing condition keys.

The service principal is 'ec2.amazonaws.com', the action is 'sts:AssumeRole', and the condition key is 'aws:SourceArn' to specify the source.