Permission set quiz · Level 0 · Todo.io Learns AWS

Question 1Todo.io hires five engineers who need access to both the Dev and Prod accounts, with less access in Prod. What is the recommended way to set this up?

Create each engineer once in IAM Identity Center, and assign permission sets per account: a broader one in Dev, a narrower one in Prod.Correct. Identity Center gives each person one sign-in for every account. A permission set becomes a role in each account it is assigned to.Create an IAM user for each engineer in each account.Not this one. That is ten users, ten passwords and ten sets of keys to manage. It works, but it is the older way.Create one shared admin IAM user in each account and give everyone the password.Not this one. Shared credentials hide who did what in CloudTrail, and give everyone more access than they need.Give the engineers the root user's MFA device, so access is still protected by MFA.Not this one. Root can do almost anything, and must not be used for daily work by anyone.

Learn it: IAM Identity Center · Permission set · Set up AWS: Day 0

Question 2Todo.io assigns the ReadOnlyAccess permission set to an engineer in its Audit account. What does Identity Center create in the Audit account?

An IAM role with the ReadOnlyAccess policy, which the engineer can assume.Correct. A permission set becomes a role in each account it is assigned to.An IAM user for the engineer.Not this one. Identity Center uses roles, not IAM users.An IAM group called ReadOnlyAccess.Not this one. Groups hold IAM users. Identity Center doesn't use them.An SCP that makes the account read-only.Not this one. That would limit everyone in the account, not grant one person access.

Learn it: Permission set

Question 3An engineer needs full access in Dev but must only be able to look, not change, in Prod. How should Todo.io set this up in IAM Identity Center?

Assign an administrator permission set in Dev and a read-only permission set in Prod.Correct. Assignments are per account, so each account gets exactly the access it needs: least privilege.Assign the administrator permission set in both accounts and trust the engineer to be careful in Prod.Not this one. Least privilege means not relying on care. Give only what the job needs.Assign the administrator permission set in both, and add an SCP to Prod that denies all changes.Not this one. That SCP would stop everyone in Prod making changes, including deployments.Create an IAM user in Prod with read-only access as well.Not this one. Two identities for one person is harder to manage and to remove.

Learn it: Permission set

Question 4What does "Permission set" mean?

A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.Correct. Think of it as: A job description that comes with the right keys in every building.One place for people to sign in and get access to many AWS accounts.Not this one. That describes IAM Identity Center.Sets up and governs a multi-account AWS environment (a landing zone) for you.Not this one. That describes AWS Control Tower.An organization-wide guardrail that sets the most any identity in an account may do.Not this one. That describes SCP (service control policy).

Learn it: Permission set

Question 5Which term is this? "A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to."

Permission setCorrect. Yes. Think of it as: A job description that comes with the right keys in every building.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do.

Learn it: Permission set

Question 6Which AWS term is described by this analogy? "A job description that comes with the right keys in every building."

Permission setCorrect. Yes: A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.IAM Identity CenterNot this one. IAM Identity Center is: One place for people to sign in and get access to many AWS accounts. Its analogy: The front desk that hands you a temporary key card for whichever flat you're cleared for.AWS Control TowerNot this one. AWS Control Tower is: Sets up and governs a multi-account AWS environment (a landing zone) for you. Its analogy: A developer who builds the whole apartment complex to code, then inspects it regularly.SCP (service control policy)Not this one. SCP (service control policy) is: An organization-wide guardrail that sets the most any identity in an account may do. Its analogy: The building's rules. Your lease can't give you permission to break them.

Learn it: Permission set

Permission set

Worth another look

Your weak spots

Services

Concepts