Gyanrush
Start freeOpen Gyanrush
Start freeOpen Gyanrush
  1. LPU MCA Semester 1
  2. CAP470
  3. Unit 8

CAP470 · Unit 8: AWS authentication and authorization

AWS IAM introduction, identities and policies

12 practice questions · in the ETE syllabus

Practise this topicPractise this topic

Key points

  • IAM is global; identities are users, groups and roles
  • Policies are JSON with Effect, Action and Resource
  • Default is deny; explicit deny overrides allow
  • Use least privilege

AWS Identity and Access Management (IAM) controls who can sign in (authentication) and what they may do (authorization). IAM is a global service: identities and policies are created once and apply in every region. IAM identities are users, groups and roles.

Policies are JSON documents. A statement has an Effect (Allow or Deny), an Action (such as s3:GetObject), a Resource (an ARN, or *) and optionally a Condition.

{"Version": "2012-10-17",
 "Statement": [{"Effect": "Allow",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::demo/*"}]}
Policy kindAttached to
Identity-basedA user, group or role
Resource-basedA resource, such as an S3 bucket

Evaluation rules: everything is denied by default (implicit deny), an explicit Allow is needed to permit an action, and an explicit Deny always overrides any Allow. Follow the principle of least privilege by granting only the actions and resources a task needs.

Exam trap: explicit deny beats allow, regardless of which policy was written first.

Try two questions

Question 1 · Tier 4, Analyse

A user has one policy that allows deleting a bucket and another policy that explicitly denies deleting it. What is the result?

  1. The deletion is denied
  2. The deletion is allowed
  3. The result depends on which policy was created first
  4. The deletion is allowed only on weekdays
Show the answer

A. In IAM evaluation an explicit deny always wins over allows.

Why not B: An explicit deny overrides any allow.

Why not C: Creation order does not matter.

Why not D: Time rules apply only if conditions are written in a policy.

Question 2 · Tier 2, Understand

Is AWS IAM a regional service or a global service?

  1. A regional service, so each region needs its own users
  2. A service that works only in the region of the first user
  3. A service that exists only in one availability zone
  4. A global service, because identities and policies apply across regions
Show the answer

D. You create IAM users and roles once and use them in every region.

Why not A: IAM identities are not created per region.

Why not B: IAM is not tied to a first user's region.

Why not C: IAM is not limited to one zone.