iam:PassRole quiz · Level 0 · Todo.io Learns AWS

Question 1A developer may create Lambda functions, but gets AccessDenied when choosing an existing execution role for a new function. What is missing?

Permission for iam:PassRole on that execution role.Correct. Giving a role to a service is "passing" it. PassRole stops people giving a service more power than they have themselves.Permission for lambda:InvokeFunction.Not this one. That is for calling a function, not creating one.Only the root user can give a role to a function.Not this one. Anyone with iam:PassRole on the role can.The role's trust policy must name the developer.Not this one. The trust policy must trust lambda.amazonaws.com, because Lambda is what assumes the role.

Learn it: iam:PassRole

Question 2A developer can create RDS databases, but creating one with an Enhanced Monitoring role fails with AccessDenied. What is missing?

Permission for iam:PassRole on the monitoring role.Correct. Handing a role to RDS is passing it, which needs iam:PassRole.The root user must create databases that have roles.Not this one. Root isn't needed; PassRole is.An SCP that allows RDS.Not this one. SCPs never grant anything.An inbound rule in the database's security group.Not this one. That is about network traffic, not about creating the database.

Learn it: iam:PassRole

Question 3What does "iam:PassRole" mean?

The permission to hand an existing role to an AWS service.Correct. Think of it as: Being allowed to lend your colleague's key card to a contractor.A role an AWS service creates and owns so it can act in your account on its own behalf.Not this one. That describes Service-linked role.Short-lived AWS keys handed out for a role, which expire automatically.Not this one. That describes Temporary credentials.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: iam:PassRole

Question 4Which term is this? "The permission to hand an existing role to an AWS service."

iam:PassRoleCorrect. Yes. Think of it as: Being allowed to lend your colleague's key card to a contractor.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: iam:PassRole

Question 5Which AWS term is described by this analogy? "Being allowed to lend your colleague's key card to a contractor."

iam:PassRoleCorrect. Yes: The permission to hand an existing role to an AWS service.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf. Its analogy: A contractor's own access badge, issued and controlled by the contractor's company.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically. Its analogy: A wristband that's only valid for today.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: iam:PassRole

iam:PassRole

Worth another look

Your weak spots

Services

Concepts