Why IAM policies protect data in DynamoDB - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the action allowed by the IAM policy.

DynamoDB

{
  "Effect": "Allow",
  "Action": "[1]",
  "Resource": "*"
}

Drag options to blanks, or click blank then click option'

Adynamodb:PutItem

Bs3:PutObject

Cec2:StartInstances

Dlambda:InvokeFunction

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing actions from other AWS services like S3 or EC2.

Using read-only actions instead of write actions.

The dynamodb:PutItem action allows writing data to a DynamoDB table, which is relevant for protecting data access with IAM policies.

2fill in blank

medium

Complete the code to specify the resource ARN for a DynamoDB table named 'Users'.

DynamoDB

"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/[1]"

Drag options to blanks, or click blank then click option'

AOrders

BLogs

CProducts

DUsers

Attempts:

3 left

💡 Hint

Common Mistakes

Using a different table name than specified.

Confusing table names with other resource types.

The resource ARN must match the DynamoDB table name you want to protect. Here, it is Users.

3fill in blank

hard

Fix the error in the IAM policy effect value.

DynamoDB

"Effect": "[1]"

Drag options to blanks, or click blank then click option'

APermitted

BAllowed

CAllow

DAuthorized

Attempts:

3 left

💡 Hint

Common Mistakes

Using synonyms like 'Allowed' or 'Permitted' which are invalid.

Misspelling the effect value.

The correct value for the effect in IAM policies is Allow. Other values cause errors.

4fill in blank

hard

Fill both blanks to complete the condition that restricts access to a specific IP address.

DynamoDB

"Condition": {
  "IpAddress": {
    "aws:SourceIp": "[1]"
  },
  "Bool": {
    "aws:SecureTransport": "[2]"
  }
}

Drag options to blanks, or click blank then click option'

A203.0.113.0/24

Btrue

Cfalse

D192.168.1.1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a single IP instead of a CIDR block for the IP condition.

Setting SecureTransport to 'false' which disables HTTPS enforcement.

The IpAddress condition restricts access to the IP range 203.0.113.0/24. The Bool condition requires aws:SecureTransport to be true to enforce HTTPS.

5fill in blank

hard

Fill all three blanks to complete the IAM policy statement allowing read access only to a DynamoDB table named 'Inventory'.

DynamoDB

{
  "Effect": "[1]",
  "Action": "[2]",
  "Resource": "arn:aws:dynamodb:us-west-2:987654321098:table/[3]"
}

Drag options to blanks, or click blank then click option'

AAllow

Bdynamodb:GetItem

CInventory

Ddynamodb:PutItem

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'dynamodb:PutItem' which allows writing instead of reading.

Setting Effect to 'Deny' which blocks access.

Using the wrong table name.

The policy must Allow the dynamodb:GetItem action on the Inventory table to grant read-only access.