Policy 1

Question 1

Policy Types

4 types of IAM Policies?

Answer 1

Identity-based, Resource-based, permission boundaries, Service Control Policies (SCPs)

Question 2

Policy Types

What can have Identity-based policies?

Answer 2

Users, Groups, Roles

Question 3

Policy Types

What type of Policies use “Principal” section?

Answer 3

Only Resource policies

Question 4

Policy Interpretation

Single policy with DENY and a Condition. What if condition isn’t true?

Answer 4

Still denied: implicit deny! You’d need an explicit Allow for this to do anything.

Question 5

Policy Interpretation

What is “NotAction”?

Answer 5

Opposite of “Action”: Careful! This means everything other than these is in scope!

Question 6

Policy Interpretation

What should you be on the lookout for on the exam with Policies?

Answer 6

“not” appearing in conditions, “NotAction”, etc. Most common way to mess up.

Question 7

Policy Interpretation

Setting up policy to deny anything not in eu-west-1. What’s the “gotcha”?

Answer 7

CloudFront, Route53, IAM, and Support run out of us-east-1 and are global.

Question 8

Policy Interpretation

S3 policy Actions around listing buckets?

Answer 8

s3:ListAllMyBuckets (all buckets owned by me), s3:ListBucket (objects in a bucket). There is no s3:ListObject*