Service-linked role quiz · Level 0

Question 1An SCP on the Prod OU denies a set of RDS actions. Which of these does the SCP NOT restrict?

Service-linked roles, such as the one RDS uses to manage its own network interfaces.Correct. SCPs never apply to service-linked roles, so AWS services can keep running what they manage for you.IAM users in the Prod account.Not this one. SCPs apply to every IAM user in a member account.IAM roles in the Prod account.Not this one. SCPs apply to every IAM role in a member account, except service-linked roles.The root user of the Prod account.Not this one. SCPs apply to root in member accounts.

Learn it: SCP (service control policy) · Service-linked role

Question 2After Todo.io created its first RDS database, a role named AWSServiceRoleForRDS appeared. What is it?

A service-linked role that RDS uses to manage things like network interfaces for your databases.Correct. The service owns it: you can't change its permissions, and it only trusts RDS.A role someone created by mistake, which should be deleted.Not this one. RDS needs it. You can only delete it once RDS no longer uses it.The role the app uses to connect to the database.Not this one. The app connects with a database username and password.A role from IAM Identity Center.Not this one. Those are named AWSReservedSSO_…

Learn it: Service-linked role

Question 3What does "Service-linked role" mean?

A role an AWS service creates and owns so it can act in your account on its own behalf.Correct. Think of it as: A contractor's own access badge, issued and controlled by the contractor's company.Short-lived AWS keys handed out for a role, which expire automatically.Not this one. That describes Temporary credentials.The permission to hand an existing role to an AWS service.Not this one. That describes iam:PassRole.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).

Learn it: Service-linked role

Question 4Which term is this? "A role an AWS service creates and owns so it can act in your account on its own behalf."

Service-linked roleCorrect. Yes. Think of it as: A contractor's own access badge, issued and controlled by the contractor's company.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.

Learn it: Service-linked role

Question 5Which AWS term is described by this analogy? "A contractor's own access badge, issued and controlled by the contractor's company."

Service-linked roleCorrect. Yes: A role an AWS service creates and owns so it can act in your account on its own behalf.Temporary credentialsNot this one. Temporary credentials is: Short-lived AWS keys handed out for a role, which expire automatically. Its analogy: A wristband that's only valid for today.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service. Its analogy: Being allowed to lend your colleague's key card to a contractor.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.

Learn it: Service-linked role

Service-linked role

Worth another look

Your weak spots

Services

Concepts