IAM policy quiz · Level 0 · Todo.io Learns AWS

Question 1In Todo.io's Prod account, a developer's role has an IAM policy that allows dynamodb:DeleteTable. An SCP attached to the Prod OU denies dynamodb:DeleteTable. The developer tries to delete a table. What happens?

The request is denied. An explicit Deny anywhere always wins.Correct. IAM checks every policy that applies. One explicit Deny, here in the SCP, overrides any number of Allows.The request is allowed, because the role's own policy is more specific than the SCP.Not this one. Specificity never matters in IAM. A Deny beats an Allow, wherever each one is written.The request is allowed, because SCPs only apply to the root user.Not this one. SCPs apply to every user and role in a member account, root included.The request is allowed, but AWS Config reports it afterwards.Not this one. Config is detective: it reports after the fact. This request never happens, because the SCP is preventive.

Learn it: IAM policy · SCP (service control policy) · Set up AWS: Wrong Region

Question 2Todo.io creates a new IAM role and attaches no policies to it. What can something using the role do?

Nothing. Every request is denied until a policy allows it.Correct. IAM starts from deny. With no Allow anywhere, every request is implicitly denied.Read anything in the account, but not change it.Not this one. There is no built-in read-only default.Anything in its own account.Not this one. A role gets nothing by being in an account.Whatever the person who created it can do.Not this one. A role's permissions come from its own policies, not from its creator.

Learn it: IAM (Identity and Access Management) · IAM policy

Question 3Which statement describes a resource-based policy?

It is attached to a resource, such as a Lambda function or an S3 bucket, and says who may use that resource.Correct. It names the principal: "API Gateway may invoke this function". The opposite of an identity policy, which is attached to the caller.It is attached to a user, group or role, and says what they may do.Not this one. That is an identity-based policy.It sets the most any identity in an account may do.Not this one. That is an SCP.It decides which Region a resource is created in.Not this one. Policies allow or deny requests. The Region is chosen when you create the resource.

Learn it: IAM policy

Question 4Todo.io's report job only reads items from the Todos table. Which policy follows the principle of least privilege?

Allow dynamodb:GetItem and dynamodb:Query on the Todos table's ARN.Correct. Only the actions the job uses, only on the one table it reads.Allow dynamodb:* on every resource.Not this one. That lets the job delete every table in the account.Attach AdministratorAccess.Not this one. That lets the job do anything in the account.Allow every action on the Todos table's ARN.Not this one. Right table, but it could also delete it.

Learn it: IAM policy

Question 5Todo.io's API Gateway invokes its Lambda function. In Todo.io's setup, which policy says that API Gateway may invoke the function?

A resource-based policy on the function.Correct. It lives on the function and names the caller (apigateway.amazonaws.com): who may use this resource.The function's execution role.Not this one. The execution role says what the function may do, not who may call it.An SCP on the account.Not this one. SCPs only cap permissions; they never grant them.A security group on the function.Not this one. Security groups filter network traffic. Invoking a function is an AWS API call, decided by IAM.

Learn it: API Gateway · IAM policy · Lambda

Question 6Todo.io's Lambda function tries to push a message to a browser by POSTing to the WebSocket API's @connections URL, and gets AccessDenied. What fixes it?

Allow execute-api:ManageConnections in the function's execution role.Correct. Pushing to a connection is an AWS API call, so IAM must allow it like any other.Open port 443 in the function's security group.Not this one. AccessDenied is an IAM answer. A network problem would time out instead.Enable CORS on the API.Not this one. CORS is about browsers calling across websites. This call comes from Lambda.Give the browser an IAM role.Not this one. The browser is the receiver here, and app users are never IAM principals.

Learn it: WebSocket (API Gateway WebSocket API) · IAM policy

Question 7Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?

Add a NAT gateway in a public subnet, and route the private subnets' internet traffic (0.0.0.0/0) to it.Correct. A VPC-attached Lambda function can only reach what its subnet can reach. A NAT gateway lets it call out to public AWS endpoints such as SQS, while nothing can call in. (A VPC endpoint is another fix, in a later level.)Move the function's network interfaces to a public subnet.Not this one. Lambda's network interfaces never get a public IP, so a public subnet doesn't help. This is a classic exam trap.Add an outbound rule for port 443 to the function's security group.Not this one. Security groups allow all outbound traffic by default, and a timeout means there's no route out at all. An outbound rule can't create a route.Add sqs:SendMessage to the function's execution role again.Not this one. IAM already allows it. A permission problem shows up as AccessDenied, not as a timeout.

Learn it: NAT gateway · Lambda · IAM policy · ENI

Question 8Todo.io's Fargate tasks run in private subnets. Their IAM permissions are correct, but every call they make to SQS times out. What fixes it?

A NAT gateway in a public subnet, with the private subnets routing 0.0.0.0/0 to it.Correct. SQS is a public AWS service. From a private subnet, traffic needs a way out. (VPC endpoints are another fix, in a later level.)An outbound rule in the task's security group.Not this one. Security groups allow outbound traffic by default; the problem is the missing route.A public IP on each task, left in the private subnet.Not this one. A public IP is useless without a route to the internet gateway.More permissions on the task role.Not this one. A permission problem returns AccessDenied, not a timeout.

Learn it: NAT gateway · IAM policy

Question 9Todo.io's app gets AccessDeniedException when it calls PutItem on the Todos table. What should be fixed?

The app's role needs a policy allowing dynamodb:PutItem on the Todos table's ARN.Correct. IAM checks every DynamoDB request, and AccessDenied means no policy allowed it.The table's security group.Not this one. DynamoDB has no security groups.The database password.Not this one. DynamoDB has no passwords; requests are signed with IAM credentials.The table is full and must be resized.Not this one. A full-table problem wouldn't be AccessDenied.

Learn it: DynamoDB · IAM policy

Question 10A teammate asks what controls who can read objects in an S3 bucket. Which answer is right?

IAM policies on the caller, and the bucket policy on the bucket itself (a resource-based policy).Correct. The bucket policy names who may use the bucket. Block Public Access can override any rule that would make it public.A security group on the bucket.Not this one. Buckets have no security groups.The subnet the bucket is in.Not this one. Buckets aren't in subnets.IAM Identity Center.Not this one. Identity Center gives people roles in accounts; it doesn't set bucket permissions.

Learn it: S3 (Simple Storage Service) · IAM policy

Question 11Todo.io's app gets AccessDenied when it calls SendMessage on its queue. What should be fixed?

The app's role needs a policy allowing sqs:SendMessage on the queue's ARN.Correct. Sending to a queue is an AWS API call, approved by IAM.The queue's security group.Not this one. Queues have no security groups.The queue is full and must be emptied.Not this one. A full queue isn't the cause of AccessDenied.The visibility timeout.Not this one. That affects receiving, not sending.

Learn it: SQS (Simple Queue Service) · IAM policy

Question 12What does "IAM policy" mean?

A JSON document listing allowed (or denied) actions on resources.Correct. Think of it as: The list of rooms printed on the back of a badge.An identity with permissions that something can "wear" temporarily. No password.Not this one. That describes IAM role.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).Decides who can do what to which AWS resource.Not this one. That describes IAM (Identity and Access Management).

Learn it: IAM policy

Question 13Which term is this? "A JSON document listing allowed (or denied) actions on resources."

IAM policyCorrect. Yes. Think of it as: The list of rooms printed on the back of a badge.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource.

Learn it: IAM policy

Question 14Which AWS term is described by this analogy? "The list of rooms printed on the back of a badge."

IAM policyCorrect. Yes: A JSON document listing allowed (or denied) actions on resources.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password. Its analogy: A visitor badge that's handed out at the door and expires.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource. Its analogy: The building's security office that issues every badge.

Learn it: IAM policy

IAM policy

Worth another look

Your weak spots

Services

Concepts