IAM (Identity and Access Management) quiz · Level 0

Question 1An SCP on Todo.io's Prod OU allows s3:*. A role in Prod has no IAM policies that mention S3, and the bucket has no bucket policy. Can the role read objects from a bucket in Prod?

No. SCPs only set the most an account can do; something must still grant the permission.Correct. An SCP never grants anything. With no identity policy and no bucket policy allowing it, the request is implicitly denied.Yes. The SCP allows s3:* for every role in the OU.Not this one. SCPs are a ceiling, not a grant. An Allow in an SCP only means "IAM may allow this here".Yes, but only for buckets in the same Region as the role.Not this one. Roles are global and Regions have nothing to do with it. Nothing grants the permission, so the answer is no.Only if the role was created through Control Tower.Not this one. How the role was created doesn't matter. Permissions come from policies, not from the tool that made the role.

Learn it: SCP (service control policy) · IAM (Identity and Access Management) · Set up AWS: Day 0

Question 2Todo.io expects 50,000 people to sign up to manage their todos. Should those customers be created in IAM Identity Center?

No. Identity Center and IAM are for people and software that manage or call AWS. App customers belong to the app.Correct. Customer sign-up and login is the app's job; Amazon Cognito does it in Level 2.Yes. Identity Center is built for large numbers of users.Not this one. It's built for staff who sign in to AWS accounts, not for an app's customers.Yes, as IAM users, so each customer has their own permissions.Not this one. Customers should never be IAM principals.Yes, with one permission set per customer.Not this one. Customers don't sign in to AWS accounts at all.

Learn it: IAM Identity Center · IAM

Question 3Todo.io creates a new IAM role and attaches no policies to it. What can something using the role do?

Nothing. Every request is denied until a policy allows it.Correct. IAM starts from deny. With no Allow anywhere, every request is implicitly denied.Read anything in the account, but not change it.Not this one. There is no built-in read-only default.Anything in its own account.Not this one. A role gets nothing by being in an account.Whatever the person who created it can do.Not this one. A role's permissions come from its own policies, not from its creator.

Learn it: IAM (Identity and Access Management) · IAM policy

Question 4Todo.io created an IAM role while the console was set to us-east-1. Can an app running in eu-west-1 use the role?

Yes. IAM is global, so roles aren't tied to a Region.Correct. A few services, IAM among them, are global. Most others, like RDS, are regional.No. The role only exists in us-east-1.Not this one. That's true of most services, but not of IAM.Only after the role is copied to eu-west-1.Not this one. There is nothing to copy; the same role works in every Region.Only if the app signs in through IAM Identity Center.Not this one. Apps use roles directly. Identity Center is for people.

Learn it: IAM (Identity and Access Management) · Region

Question 5What does "IAM (Identity and Access Management)" mean?

Decides who can do what to which AWS resource.Correct. Think of it as: The building's security office that issues every badge.An identity with permissions that something can "wear" temporarily. No password.Not this one. That describes IAM role.A JSON document listing allowed (or denied) actions on resources.Not this one. That describes IAM policy.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: IAM (Identity and Access Management)

Question 6Which term is this? "Decides who can do what to which AWS resource."

IAM (Identity and Access Management)Correct. Yes. Think of it as: The building's security office that issues every badge.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: IAM (Identity and Access Management)

Question 7Which AWS term is described by this analogy? "The building's security office that issues every badge."

IAM (Identity and Access Management)Correct. Yes: Decides who can do what to which AWS resource.IAM roleNot this one. IAM role is: An identity with permissions that something can "wear" temporarily. No password. Its analogy: A visitor badge that's handed out at the door and expires.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources. Its analogy: The list of rooms printed on the back of a badge.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: IAM (Identity and Access Management)

IAM (Identity and Access Management)

Worth another look

Your weak spots

Services

Concepts