Checkpoint: Identity and Security

Five questions on this section. Answer all of them, then see your score and why each answer is right or wrong.

This policy is attached to Sam, yet aws s3 ls s3://lantern-posters/ returns AccessDenied. Why?

JSON

{
  "Effect": "Allow",
  "Action": "s3:ListBucket",
  "Resource": "arn:aws:s3:::lantern-posters/*"
}

s3:ListBucket acts on the bucket, so the Resource must be arn:aws:s3:::lantern-posters without /*.
Listing needs s3:GetObject as well.
The statement needs a Principal element.
S3 listing always requires MFA.

Lantern’s GitHub Actions workflow deploys the site to S3. What is the recommended way to give it AWS permissions?

Store an IAM user’s access key and secret as repository secrets.
Use the admin user’s aws login session from a maintainer’s laptop.
Make the site bucket public-write so the workflow needs no credentials.
Add GitHub as an OpenID Connect identity provider in IAM and let the workflow assume a deploy role whose trust policy names the repository.

A developer’s policies include an Allow for ec2:* on * and this statement. What happens when they launch an instance in us-east-1?

JSON

{
  "Effect": "Deny",
  "Action": "ec2:*",
  "Resource": "*",
  "Condition": { "StringNotEquals": { "aws:RequestedRegion": "eu-west-1" } }
}

It succeeds, because the Allow for ec2:* was written first.
It succeeds, because conditions only apply to Allow statements.
It is denied, because the request’s Region is not eu-west-1, so the explicit Deny matches.
It is denied, because ec2:* is not a valid action pattern.

A volunteer leaves Lantern. Everyone signs in through IAM Identity Center with permission sets in the dev and production accounts. What do you do?

Delete the IAM roles named after the volunteer in each account.
Disable or delete the volunteer’s user in Identity Center, which removes their access to every assigned account.
Rotate the access keys of every IAM user in both accounts.
Change the root user’s password in both accounts.

A scanner reports that an active access key for Lantern’s IAM user export-bot was pushed to a public GitHub repository an hour ago. What should you do first?

Delete the repository so nobody else can find the key.
Check the key’s last-used date and decide based on that.
Open a support case and wait for AWS to revoke it.
Deactivate the key immediately, then review CloudTrail for what it was used for and replace it with a role.

5 questions unanswered