AWS Certified Solutions Architect IAM Policies and User Roles 3 — Questions and Answers
Question 1: A Lambda function needs to write logs to CloudWatch and read from DynamoDB. What is the BEST way to grant these permissions?
- Hardcode IAM user credentials in the Lambda environment variables
- Create an IAM role with the required policies and attach it as the Lambda execution role (Correct answer)
- Add the Lambda function ARN to the CloudWatch and DynamoDB resource-based policies
- Use an IAM group to manage Lambda function permissions
Correct answer: Create an IAM role with the required policies and attach it as the Lambda execution role
Lambda execution roles are IAM roles that grant the function permission to access AWS services, following the principle of least privilege.
Question 2: What is the maximum number of IAM roles that can be assumed in a single role chaining session?
- 2
- 5 (Correct answer)
- 10
- There is no limit
Correct answer: 5
AWS limits role chaining to a maximum of 5 role assumptions in a single session to prevent privilege escalation chains.
Question 3: Which policy type can be used to set guardrails that restrict the maximum permissions available to all accounts in an AWS Organization?
- IAM Permissions Boundaries
- Service Control Policies (SCPs) (Correct answer)
- Resource-based policies
- Session policies
Correct answer: Service Control Policies (SCPs)
SCPs are Organization policies that set the maximum permissions for member accounts, restricting what actions even the root user can perform.
Question 4: An application running on ECS tasks needs to access Secrets Manager. What credential mechanism should be used?
- Embed IAM user keys in the ECS task definition
- Assign an IAM role as the ECS task role (Correct answer)
- Use the ECS cluster role for all task access
- Configure VPC endpoints only
Correct answer: Assign an IAM role as the ECS task role
The ECS task role is an IAM role that grants permissions to the containers within the task, providing temporary credentials without embedding secrets.
Question 5: What condition key would you use in an IAM policy to require that requests come from a specific IP address range?
- aws:SourceVpc
- aws:PrincipalArn
- aws:SourceIp (Correct answer)
- aws:CalledVia
Correct answer: aws:SourceIp
The aws:SourceIp condition key restricts access based on the requester's IP address, allowing you to allow or deny requests from specific CIDR ranges.
Question 6: Which IAM entity should you use to delegate access to AWS services on behalf of an AWS account, rather than assigning permissions to a person?
- IAM User
- IAM Group
- IAM Role (Correct answer)
- IAM Policy
Correct answer: IAM Role
IAM roles are designed to be assumed by services, applications, or other AWS accounts rather than being permanently associated with a person.
Question 7: What happens when an SCP in AWS Organizations denies an action, but an IAM policy in the member account explicitly allows it?
- The IAM policy allow takes precedence
- The SCP deny takes precedence and the action is blocked (Correct answer)
- AWS prompts the account administrator for approval
- The action is allowed if the root user makes the request
Correct answer: The SCP deny takes precedence and the action is blocked
SCPs act as guardrails that override IAM policies; an SCP deny blocks the action regardless of what any identity-based policy allows.
AWS Certified Solutions Architect IAM Policies and User Roles 3
A Lambda function needs to write logs to CloudWatch and read from DynamoDB.
What is the BEST way to grant these permissions?