AWS Certified Solutions Architect IAM Policies and User Roles 3

Question 1

A Lambda function needs to write logs to CloudWatch and read from DynamoDB. What is the BEST way to grant these permissions?

Accepted Answer

Create an IAM role with the required policies and attach it as the Lambda execution role

Answer

Lambda execution roles are IAM roles that grant the function permission to access AWS services, following the principle of least privilege.

Question 2

What is the maximum number of IAM roles that can be assumed in a single role chaining session?

Accepted Answer

5

Answer

AWS limits role chaining to a maximum of 5 role assumptions in a single session to prevent privilege escalation chains.

Question 3

Which policy type can be used to set guardrails that restrict the maximum permissions available to all accounts in an AWS Organization?

Accepted Answer

Service Control Policies (SCPs)

Answer

SCPs are Organization policies that set the maximum permissions for member accounts, restricting what actions even the root user can perform.

Question 4

An application running on ECS tasks needs to access Secrets Manager. What credential mechanism should be used?

Accepted Answer

Assign an IAM role as the ECS task role

Answer

The ECS task role is an IAM role that grants permissions to the containers within the task, providing temporary credentials without embedding secrets.

Question 5

What condition key would you use in an IAM policy to require that requests come from a specific IP address range?

Accepted Answer

aws:SourceIp

Answer

The aws:SourceIp condition key restricts access based on the requester's IP address, allowing you to allow or deny requests from specific CIDR ranges.

AWS Practice Test

AWS Practice Test

AWS Certified Solutions Architect IAM Policies and User Roles 3