Auditing and troubleshooting access: SOA-C03 study notes and practice questions
What to know about Auditing and troubleshooting access for the SOA-C03 exam, from the Security and Compliance domain (16% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.
These questions describe an “AccessDenied” that shouldn’t be happening, or ask how to audit who has access.
Why a request is denied despite an Allow
Check every layer, in roughly this order:
SCPs and RCPs in AWS Organizations (an SCP Deny or a missing Allow in an allow-list SCP).
Permissions boundary on the user or role.
Session policy passed when the role was assumed.
Identity-based policy: the right action, resource ARN and conditions?
Resource-based policy: for cross-account access, it must allow the caller.
KMS key policy: encrypted resources also need kms:Decrypt (or other KMS actions) allowed on the key.
VPC endpoint policy: requests through an endpoint must be allowed by it.
Explicit Deny in any of these wins.
Many error messages now name the policy type that caused the denial, which narrows the search.
Tools
Tool
Use
AWS CloudTrail
See the denied call, who made it and the error code
IAM policy simulator
Test whether a policy allows an action before or after a change
IAM Access Analyzer
Find resources shared outside your account or organization (external access), unused roles, keys and permissions, and validate policies against best practices
IAM last accessed information
See which services a role actually uses, to trim permissions
Credential report
Users, keys, passwords and MFA status in one CSV
Auditing
Set the zone of trust in Access Analyzer to the organization to flag any access from outside it.
Use unused access analyzers to remove permissions nobody uses.
Review CloudTrail for sensitive actions, and alert on them with EventBridge.
Common traps
Only checking the identity policy. SCPs, boundaries and key policies deny silently from the user’s view.
Encrypted S3 objects returning Access Denied: the KMS key policy is missing the caller.
Access Analyzer vs Config. Access Analyzer is about who can access; Config is about how resources are configured.
At a ski resort, developers use an IAM role named dev-ops whose identity-based policy allows ec2:* on all resources.
The role also has a permissions boundary that allows s3:*, logs:* and cloudwatch:*. The account is in an organizational unit whose SCPs allow all actions.
When a developer calls ec2:RunInstances, the request fails with an AccessDenied error.
What is the cause, and how should it be fixed?
Choose one answer.
AA. The SCP denies EC2 implicitly because it allows all actions, so the SCP must list ec2:RunInstances explicitly.
BB. The identity-based policy needs a resource-level ARN for each subnet and AMI, because ec2:* on all resources is not supported.
CC. The role's trust policy does not allow the developers to call EC2, so the trust policy must add ec2.amazonaws.com as a principal.
DD. The permissions boundary does not allow EC2 actions, so the effective permissions exclude them; the boundary must be updated to allow the needed EC2 actions.
C. Wrong: The trust policy controls who can assume the role, and the developers already assume it successfully. Adding the EC2 service as a principal would not grant API permissions. Learn more: IAM roles (opens in a new tab)
When a request is denied despite an Allow, check every policy type in the evaluation chain: SCPs, permissions boundaries, identity policies and session policies. A permissions boundary caps the role's permissions, so an action must be allowed by both the boundary and the identity policy. The IAM policy simulator can show which policy blocks the call.
An esports league has 25 AWS accounts in one AWS Organization.
After a contractor left, the security team wants a continuous list of every IAM role, S3 bucket, KMS key and Lambda function in any account whose resource-based policy grants access to a principal outside the organization.
New resources must be checked automatically.
What should a CloudOps engineer set up with the LEAST effort?
Choose one answer.
AA. Amazon Macie in every account, with a weekly sensitive data discovery job across all S3 buckets.
BB. The IAM policy simulator, run weekly against every role and resource policy in each account by a scheduled script.
CC. An IAM Access Analyzer analyzer with the organization as its zone of trust, in a delegated admin account.
DD. The Trusted Advisor security checks in every account, reviewed by the security team at the start of each week.
Show the answer and explanation
Answer: C
A. Wrong: Macie discovers sensitive data in S3 and reports on bucket security. It does not analyze IAM role trust policies, KMS key policies or Lambda function policies. Learn more: What is Amazon Macie? (opens in a new tab)
C. Right: Correct. An organization analyzer reviews resource-based policies in every member account and reports resources shared with principals outside the zone of trust. It updates findings when policies change. Learn more: IAM Access Analyzer findings (opens in a new tab)
IAM Access Analyzer uses automated reasoning to find resources whose policies grant access outside a zone of trust. With the organization as the zone of trust, one analyzer covers every member account and keeps findings current as policies change. Macie, the policy simulator and Trusted Advisor answer different questions.
Want more on Auditing and troubleshooting access? The 5 full-length practice sets have 7 more Auditing and troubleshooting access questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →