ExamPark
Course menuSOA-C03

Exams / SOA-C03 / Study guide / IAM users, roles and policies

IAM users, roles and policies: SOA-C03 study notes and practice questions

What to know about IAM users, roles and policies for the SOA-C03 exam, from the Security and Compliance domain (16% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

IAM questions in this exam are practical: write or fix a policy, give a service or vendor access, enforce MFA.

Policy types

Type Attached to Purpose
Identity-based Users, groups, roles What the identity can do
Resource-based S3 buckets, SQS queues, KMS keys, Lambda functions and more Who can access the resource, including other accounts
Permissions boundary Users, roles The maximum an identity can be given
SCP / RCP Organization accounts and OUs The maximum for accounts
Session policy A role session Narrows permissions for one session

Evaluation

  1. An explicit Deny anywhere wins.
  2. Otherwise, an Allow is needed, and it must fit inside every SCP, permissions boundary and session policy that applies.
  3. With no Allow, the request is implicitly denied.

Use explicit Deny to carve exceptions out of broad policies (for example, allow EC2 actions but deny ec2:TerminateInstances on production tags).

Practical patterns

  • Roles for services: EC2 instance profiles, Lambda execution roles, ECS task roles.
  • Third-party access: a cross-account role with an external ID in the trust policy, never shared access keys.
  • Enforce MFA: a condition on aws:MultiFactorAuthPresent that denies sensitive actions without MFA.
  • Restrict by tag: conditions on aws:ResourceTag and aws:PrincipalTag (attribute-based access control).
  • Restrict by network: aws:SourceIp, aws:SourceVpc, aws:SourceVpce.
  • Password policy and access key rotation for any remaining IAM users; prefer IAM Identity Center for people.

Common traps

  • Granting *:* to fix an error. Find the specific action.
  • Sharing access keys with a vendor. Use a role with an external ID.
  • Forgetting the resource policy for cross-account access to S3, KMS or SQS: both sides must allow.

Try the 2 practice questions

Practice IAM users, roles and policiesTake the free practice exam

Question 1

Medium ·Link to this question (question 1)

A logistics broker's operations engineers sign in as IAM users with AdministratorAccess.

After an accidental mass termination of EC2 instances, the security team requires that ec2:TerminateInstances and ec2:StopInstances succeed only when the caller signed in with MFA.

Engineers must keep all their other permissions, whether or not they used MFA.

Which policy change should a CloudOps engineer make for the engineers' group?

Choose one answer.

  1. A. Update the account password policy to require MFA for every IAM user who calls EC2 stop or terminate actions.
  2. B. Add a policy that allows the two actions only with the condition Bool aws:MultiFactorAuthPresent true.
  3. C. Add a policy that denies the two actions with the condition BoolIfExists aws:MultiFactorAuthPresent false.
  4. D. Remove AdministratorAccess and require engineers to assume a role through IAM Identity Center for every task they perform.
Show the answer and explanation

Answer: C

Explanation

Explicit Deny statements always win in IAM policy evaluation, so they are the way to restrict an action that a broad policy allows. aws:MultiFactorAuthPresent shows whether the caller authenticated with MFA, and BoolIfExists treats a missing key, as with long-term access keys, as not authenticated with MFA. Allow statements with conditions cannot remove permissions granted elsewhere.

Study

Question 2

Medium ·Link to this question (question 2)

A dental chain has hired a third-party monitoring company that needs read-only access to CloudWatch metrics and alarms in the chain's production account.

The vendor uses its own AWS account to access the accounts of hundreds of customers.

The chain's security team does not want long-term credentials shared, and it wants protection against another vendor customer tricking the vendor into accessing the chain's account.

What should a CloudOps engineer set up?

Choose one answer.

  1. A. An IAM user with CloudWatchReadOnlyAccess whose access keys are given to the vendor and rotated every 90 days.
  2. B. An IAM role with CloudWatchReadOnlyAccess that trusts the vendor's account, with no conditions in the trust policy.
  3. C. A resource-based policy on the account's CloudWatch metrics that grants the vendor's account read access to all namespaces.
  4. D. An IAM role with read-only CloudWatch access that trusts the vendor's account and requires an external ID.
Show the answer and explanation

Answer: D

Explanation

Third-party access should use a cross-account IAM role, so the vendor gets temporary credentials and nothing long-lived is shared. Because the vendor serves many customers, the trust policy should require an external ID that is unique to this customer. That prevents the confused deputy problem.

Study

Want more on IAM users, roles and policies? The 5 full-length practice sets have 10 more IAM users, roles and policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study IAM users, roles and policies

More Security and Compliance topics