Timedora
Free Online Flashcard Deck

3 Policies and Permissions Free Online FlashCards

Study 3 Policies and Permissions with 12 free online flashcards. Review key terms, definitions, and concepts with this interactive flashcard deck.

12 cards
01
Front

What do AWS IAM policies define?

Back

AWS IAM policies define what an authenticated principal, such as a user or assumed role, may do to a resource.

02
Front

What must be matched to evaluate an IAM access request?

Back

Match the principal, requested action, target resource, and any relevant conditions against applicable policies.

03
Front

What does the Effect field specify?

Back

Effect specifies whether a statement is an Allow or a Deny.

04
Front

What does the Action field identify?

Back

Action identifies the AWS operation or operations covered by the statement, such as s3:GetObject.

05
Front

What does the Resource field identify?

Back

Resource identifies the resource ARN or ARNs to which the statement applies.

06
Front

How does Principal differ between identity-based and resource-based policies?

Back

Identity-based policies omit Principal because the attached identity is implied. Resource-based policies specify the principal they address.

07
Front

What role does Condition play in an IAM statement?

Back

Condition sets context requirements, such as a source IP address or a required tag, that must match the request.

08
Front

How do S3 object reading and bucket listing differ in IAM?

Back

Reading an object requires s3:GetObject on an object ARN. Listing a bucket requires the separate s3:ListBucket action, normally on the bucket ARN.

09
Front

What happens when no applicable IAM Allow exists?

Back

IAM starts with an implicit deny: if no applicable Allow exists, the request has no access.

10
Front

How does an explicit Deny affect an applicable Allow?

Back

An applicable explicit Deny overrides an Allow, so finding an Allow alone does not establish that access will succeed.

11
Front

Do permissions boundaries, session policies, and SCPs grant access?

Back

Permissions boundaries, session policies, and SCPs limit permissions; they do not grant permissions by themselves.

12
Front

How can identity-based and resource-based policies affect same-account access?

Back

For a same-account request, identity-based and resource-based policies can both contribute an Allow, subject to applicable limits and explicit denies.