IAM role quiz · Level 0 · Todo.io Learns AWS

Question 1Todo.io creates a new member account from its management account with AWS Organizations. Nobody knows a password for the new account. How does an administrator get in the first time?

From the management account, assume the OrganizationAccountAccessRole that Organizations created in the new account.Correct. Organizations creates that role in every account it creates, and trusts the management account to assume it. Borrowing a role means no new passwords or keys.Sign in to the new account as root with the management account's password.Not this one. Each account has its own root user and email address. The management account's password doesn't open it.Use the IAM user that Organizations creates for the administrator.Not this one. Organizations creates a role, not an IAM user.Wait for the new account to accept an invitation.Not this one. Invitations are for existing accounts that join. A new account created by the organization is a member at once.

Learn it: AWS Organizations · Set up AWS: Day 0 · IAM role

Question 2A Todo.io Lambda function must write to a DynamoDB table. How should it get that permission?

Give the function an execution role whose policy allows writing to that table.Correct. Software gets AWS permissions from a role. Lambda hands the function the role's temporary credentials.Store an IAM user's access keys in the function's environment variables.Not this one. Long-lived keys in configuration can leak, and never expire.Add a resource-based policy to the function that allows DynamoDB.Not this one. A function's resource-based policy says who may call it, not what it may call.Open the table's security group to the function.Not this one. DynamoDB has no security group. IAM approves every call.

Learn it: IAM role · Lambda

Question 3Which part of an IAM role decides who is allowed to assume it?

Its trust policy.Correct. The trust policy names who may wear the role, such as ec2.amazonaws.com. The permissions policy says what the wearer can do.Its permissions policy.Not this one. That says what the role can do once assumed, not who may assume it.An SCP on the account.Not this one. An SCP caps what the role can do. It doesn't name who may assume it.The role's ARN.Not this one. The ARN is only the role's name.

Learn it: IAM role

Question 4The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?

Attach an IAM role to the instance through an instance profile.Correct. The SDK fetches temporary credentials for the role from the instance itself, and they rotate automatically. There are no long-lived keys to leak.Create an IAM user's access keys and put them in the app's config file.Not this one. Long-lived keys in a file get copied, committed to Git and forgotten. Anyone who finds them has the access.Pass access keys to the instance in its user data.Not this one. User data is readable by anything on the instance and isn't secret. It's no safer than a config file.Use the root user's access keys, because they never expire.Not this one. Never expiring is the problem. Root keys should not exist at all.

Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2

Question 5Todo.io's app on EC2 has a role attached through an instance profile. Where does the AWS SDK get the role's credentials from?

From the instance metadata service at 169.254.169.254, on the instance's host.Correct. The SDK asks for temporary credentials and refreshes them before they expire. Nothing is stored in a file.From a file the team uploads to the instance.Not this one. That would be long-lived keys on disk, which roles exist to avoid.From an S3 bucket.Not this one. Credentials are never fetched from a bucket.From the IAM Identity Center access portal.Not this one. The portal is for people. Software on EC2 uses its instance profile.

Learn it: Temporary credentials · IAM role

Question 6Code inside Todo.io's ECS task must send messages to SQS. Which role should be allowed sqs:SendMessage?

The task role.Correct. The task role is what your code may do. Its credentials are served inside the task.The task execution role.Not this one. That is what ECS itself needs to start the task: pull the image and ship logs.An instance profile on an EC2 host.Not this one. On Fargate there is no host of yours, and the task role keeps permissions per task.A service-linked role.Not this one. Those belong to AWS services, and you can't add permissions to them.

Learn it: ECS and Fargate · IAM role

Question 7How many execution roles does a Lambda function have?

Exactly one. Its permissions are everything the function's code can do in AWS.Correct. Give that one role only what the function needs.One per caller.Not this one. Who may call the function is set by its resource-based policy, not by extra roles.One per run.Not this one. Every run uses the same role.None. Functions get permissions from the account.Not this one. Nothing gets permissions just by being in an account.

Learn it: Lambda · IAM role

Question 8What does "IAM role" mean?

An identity with permissions that something can "wear" temporarily. No password.Correct. Think of it as: A visitor badge that's handed out at the door and expires.Decides who can do what to which AWS resource.Not this one. That describes IAM (Identity and Access Management).A JSON document listing allowed (or denied) actions on resources.Not this one. That describes IAM policy.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: IAM role

Question 9Which term is this? "An identity with permissions that something can "wear" temporarily. No password."

IAM roleCorrect. Yes. Think of it as: A visitor badge that's handed out at the door and expires.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: IAM role

Question 10Which AWS term is described by this analogy? "A visitor badge that's handed out at the door and expires."

IAM roleCorrect. Yes: An identity with permissions that something can "wear" temporarily. No password.IAM (Identity and Access Management)Not this one. IAM (Identity and Access Management) is: Decides who can do what to which AWS resource. Its analogy: The building's security office that issues every badge.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources. Its analogy: The list of rooms printed on the back of a badge.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: IAM role

IAM role

Worth another look

Your weak spots

Services

Concepts