Why IAM is foundational in AWS - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an IAM user named 'Alice'.

AWS

aws iam create-user --user-name [1]

Drag options to blanks, or click blank then click option'

AAdmin

BAlice

CRoot

DGuest

Attempts:

3 left

💡 Hint

Common Mistakes

Using role names instead of user names.

Using reserved names like 'Root'.

The command creates an IAM user named 'Alice'. This is the correct user name for this example.

2fill in blank

medium

Complete the code to attach the 'ReadOnlyAccess' policy to the IAM user.

AWS

aws iam attach-user-policy --user-name Alice --policy-arn [1]

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::aws:policy/ReadOnlyAccess

Barn:aws:iam::aws:policy/AdministratorAccess

Carn:aws:iam::aws:policy/PowerUserAccess

Darn:aws:iam::aws:policy/IAMFullAccess

Attempts:

3 left

💡 Hint

Common Mistakes

Using the AdministratorAccess policy ARN instead of ReadOnlyAccess.

Confusing policy ARNs.

The 'ReadOnlyAccess' policy ARN is used to give read-only permissions to the user.

3fill in blank

hard

Fix the error in the command to list all IAM users.

AWS

aws iam [1]-users

Drag options to blanks, or click blank then click option'

Ashow

Bdescribe

Cget

Dlist

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'show-users' or 'get-users' which are invalid commands.

Confusing AWS CLI verbs.

The correct AWS CLI command to list IAM users is 'aws iam list-users'.

4fill in blank

hard

Fill both blanks to create a policy document that allows listing S3 buckets.

AWS

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "[1]",
    "Resource": "[2]"
  }]
}

Drag options to blanks, or click blank then click option'

As3:ListAllMyBuckets

Barn:aws:s3:::*

Cs3:PutObject

Darn:aws:s3:::example-bucket/*

Attempts:

3 left

💡 Hint

Common Mistakes

Using write actions like 's3:PutObject' instead of list actions.

Restricting resource to a single bucket instead of all buckets.

The action 's3:ListAllMyBuckets' allows listing all buckets, and the resource 'arn:aws:s3:::*' applies to all buckets.

5fill in blank

hard

Fill all three blanks to create an IAM role trust policy allowing EC2 to assume the role.

AWS

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "[1]"},
    "Action": "[2]",
    "Condition": {"ArnLike": {"[3]": "arn:aws:ec2:*:*:instance/*"}}
  }]
}

Drag options to blanks, or click blank then click option'

Aec2.amazonaws.com

Bsts:AssumeRole

Caws:SourceArn

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong service principal names.

Using incorrect action names.

Confusing condition keys.

The service principal is 'ec2.amazonaws.com', the action is 'sts:AssumeRole', and the condition key is 'aws:SourceArn' to specify the source.

Practice

1. Why is IAM considered foundational in AWS cloud security?

easy

A. Because it stores all your data securely

B. Because it controls who can access and manage AWS resources

C. Because it automatically backs up your cloud resources

D. Because it monitors network traffic in real-time

Solution

1. Step 1: Understand IAM's role

   IAM (Identity and Access Management) controls user permissions and access to AWS resources.

2. Step 2: Compare with other options

   Storing data, backups, and network monitoring are handled by other AWS services, not IAM.

3. Final Answer:

   Because it controls who can access and manage AWS resources -> Option B

4. Quick Check:

   IAM controls access = A [OK]

Hint: IAM manages access permissions, not data or backups [OK]

Common Mistakes:

• Confusing IAM with data storage services
• Thinking IAM handles backups automatically
• Assuming IAM monitors network traffic

2. Which of the following is the correct way to create an IAM user using AWS CLI?

easy

A. aws iam create-user --user-name MyUser

B. aws iam add-user --name MyUser

C. aws create iam user --username MyUser

D. aws iam new-user --user MyUser

Solution

1. Step 1: Recall AWS CLI syntax for IAM user creation

   The correct command is 'aws iam create-user --user-name <UserName>'.

2. Step 2: Verify options

   The other options use incorrect commands or flags not recognized by AWS CLI.

3. Final Answer:

   aws iam create-user --user-name MyUser -> Option A

4. Quick Check:

   Correct AWS CLI syntax = B [OK]

Hint: Remember 'create-user' with '--user-name' flag for IAM user creation [OK]

Common Mistakes:

• Using incorrect command verbs like 'add-user' or 'new-user'
• Mixing up flag names like '--name' instead of '--user-name'
• Incorrect command order or syntax

3. Given the following IAM policy snippet, what permission does it grant?

{
  "Effect": "Allow",
  "Action": "s3:ListBucket",
  "Resource": "arn:aws:s3:::example-bucket"
}

medium

A. Allows deleting the example-bucket

B. Allows uploading files to example-bucket

C. Allows listing all S3 buckets in the account

D. Allows listing the bucket itself (like seeing bucket contents)

Solution

1. Step 1: Understand the 's3:ListBucket' action

   This action allows listing the bucket's contents, meaning seeing the objects inside the bucket.

2. Step 2: Differentiate from other actions

   Uploading requires 's3:PutObject', deleting requires 's3:DeleteBucket', so those are incorrect.

3. Final Answer:

   Allows listing the bucket itself (like seeing bucket contents) -> Option D

4. Quick Check:

   s3:ListBucket = list bucket contents = A [OK]

Hint: 'ListBucket' means see bucket contents, not upload or delete [OK]

Common Mistakes:

• Confusing 'ListBucket' with upload or delete permissions
• Assuming it allows full access to bucket
• Ignoring the specific action in the policy

4. You created an IAM policy but users still cannot access the S3 bucket. What is the most likely error?

medium

A. The AWS CLI is outdated

B. The S3 bucket does not exist

C. The policy is attached to the wrong IAM user or group

D. IAM policies do not control S3 access

Solution

1. Step 1: Check policy attachment

   Policies must be attached to the correct IAM user, group, or role to grant permissions.

2. Step 2: Eliminate other options

   The bucket existing is separate; IAM policies do control S3 access; AWS CLI version does not affect permissions.

3. Final Answer:

   The policy is attached to the wrong IAM user or group -> Option C

4. Quick Check:

   Policy attachment controls access = D [OK]

Hint: Check if policy is attached to correct user or group [OK]

Common Mistakes:

• Assuming bucket existence causes permission issues
• Thinking IAM policies don't control S3 access
• Blaming AWS CLI version for permission errors

5. You want to securely allow a Lambda function to read items from a DynamoDB table. Which IAM approach is best?

hard

A. Create an IAM role with read permissions on the DynamoDB table and assign it to the Lambda function

B. Create an IAM user with full DynamoDB access and embed its credentials in the Lambda code

C. Attach a policy with full S3 access to the Lambda function

D. Use the root AWS account credentials inside the Lambda function

Solution

1. Step 1: Identify secure best practice for Lambda permissions

   Assigning an IAM role with least privilege (read-only) to Lambda is secure and recommended.

2. Step 2: Evaluate other options

   Embedding user credentials or root credentials is insecure; S3 access is unrelated to DynamoDB.

3. Final Answer:

   Create an IAM role with read permissions on the DynamoDB table and assign it to the Lambda function -> Option A

4. Quick Check:

   Use IAM role with least privilege for Lambda = C [OK]

Hint: Use IAM roles, not user credentials, for Lambda permissions [OK]

Common Mistakes:

• Embedding IAM user credentials in code
• Using root account credentials anywhere
• Granting unrelated permissions like full S3 access