Question 1

What are the four building blocks of an IAM policy?

Accepted Answer

Principal (who), Action (what API), Resource (what target), Condition (optional context like MFA, IP, time). The policy JSON declares all four.

Question 2

Explain IAM policy evaluation logic.

Accepted Answer

By default all requests are denied. Explicit Allow is required. Explicit Deny always wins. Evaluation is layered: SCP → resource policy → permissions boundary → session policy → identity policy.

Question 3

Why prefer IAM roles over IAM user access keys?

Accepted Answer

Roles issue short-lived STS credentials that expire automatically. Access keys are long-lived and leak. Roles eliminate the #1 source of AWS credential compromise.

Question 4

What is an SCP?

Accepted Answer

A Service Control Policy is an org-level guardrail that defines the maximum permissions any account in an OU can have. SCPs cannot grant permissions — they can only cap what identity policies allow.

Question 5

What is a permissions boundary?

Accepted Answer

A permissions boundary is an IAM policy attached to a user/role that caps their maximum permissions. Useful for sandboxed dev accounts or for delegated admins. It evaluates between the resource policy and the identity policy.

Question 6

What is IRSA?

Accepted Answer

IAM Roles for Service Accounts. EKS pods get pod-level AWS credentials via OIDC federation with an IAM role. No node-level IAM. The pod's ServiceAccount maps to the role via an EKS OIDC provider.

Question 7

How does AWS Identity Center work?

Accepted Answer

Identity Center (formerly SSO) is AWS-managed single sign-on. Connect Okta/Entra ID via SAML/SCIM. Map IdP groups to AWS Permission Sets (which become IAM roles). Users get short-lived AWS credentials via their IdP.

Question 8

What is a trust policy vs a permission policy?

Accepted Answer

A trust policy defines WHO can assume the role (e.g. a specific AWS account, a specific SAML IdP). A permission policy defines WHAT the role can do once assumed. Both are required for a complete IAM role.

Question 9

How would you give a developer read-only access to one S3 bucket?

Accepted Answer

Use Identity Center with a permission set scoped to that bucket: `{ "Action": ["s3:GetObject", "s3:ListBucket"], "Resource": ["arn:aws:s3:::bucket", "arn:aws:s3:::bucket/*"] }`. No IAM user, no access keys.

Question 10

What is an ExternalId and when is it used?

Accepted Answer

An ExternalId is a secret string passed to `sts:AssumeRole` that must match the trust policy. Used for third-party cross-account access to prevent the confused deputy problem. Required for SaaS vendors accessing customer AWS accounts.

Question 11

How do you enforce MFA on the AWS console?

Accepted Answer

Use Identity Center and configure the IdP to require MFA. For IAM user access (legacy), attach an `aws:MultiFactorAuthPresent` condition to the identity policy and enable MFA enforcement in IAM settings.

Question 12

What is the difference between Identity-based and Resource-based policies?

Accepted Answer

Identity-based policies attach to IAM users/roles/groups. Resource-based policies attach to resources like S3 buckets or KMS keys. Resource-based policies can grant cross-account access without assuming a role.

Question 13

How does Access Analyzer help?

Accepted Answer

IAM Access Analyzer continuously validates IAM policies against AWS best practices (e.g. flagging wildcard actions) and detects public/cross-account access in resource policies. Run it as part of every IAM change.

Question 14

How do you manage AWS credentials in a CI/CD pipeline?

Accepted Answer

Use OIDC federation between the CI provider (GitHub Actions, GitLab, Jenkins) and AWS. The pipeline receives short-lived STS credentials per run. No long-lived access keys stored anywhere.

Question 15

What is AWS Organizations used for?

Accepted Answer

Multi-account governance. Hierarchical OUs, consolidated billing, Service Control Policies (SCPs), and Reserved Instance / Savings Plan sharing across the organisation.

Question 16

How do you give one AWS account access to resources in another?

Accepted Answer

Option 1: cross-account IAM role — Account A assumes role in Account B. Option 2: resource-based policy on the target resource (e.g. S3 bucket policy). For most cases, the role approach is preferred for audit clarity.

Question 17

What is the IAM policy size limit?

Accepted Answer

Managed policies: 6,144 characters. Inline policies: same. Per-role policy size: managed policies only since 2022. Use multiple policies for complex permissions rather than one giant JSON.

Question 18

How would you audit IAM for least privilege?

Accepted Answer

Enable IAM Access Analyzer. Run AWS Config rules (`iam-user-mfa-enabled`, `iam-root-access-key-check`). Use CloudTrail + Athena to query actual API usage and remove unused permissions. Review quarterly.

Question 19

What is the AWS account root user and why should it be locked down?

Accepted Answer

The root user has unrestricted access to the account. Best practice: enable MFA on root, do not use root for daily operations (use Identity Center / IAM roles), delete root access keys if any exist, monitor root activity via CloudTrail.

Question 20

What is a Permission Set?

Accepted Answer

An Identity Center concept — a template for IAM role permissions that you assign to users/groups. Permission Sets are mapped to AWS accounts via assignments. Users get a role per assigned account.

Question 21

How do you handle break-glass admin access?

Accepted Answer

Use a dedicated break-glass IAM user (or Identity Center user) with administrator access, MFA enforced, stored in a sealed envelope with security. CloudWatch alarm on any break-glass usage. Test the procedure quarterly.

Question 22

What is the confused deputy problem?

Accepted Answer

When a third party uses their own credentials to access your resources in a way that tricks your policies. Mitigation: ExternalId in the trust policy so the third party cannot impersonate arbitrary customers.

Question 23

How do you securely share an S3 bucket across accounts?

Accepted Answer

Option 1: bucket policy granting read to specific account/role. Option 2: same-region cross-account role assumed by the consumer. Always combine with KMS encryption for sensitive data.

Question 24

What is the principle of least privilege in IAM?

Accepted Answer

Grant only the permissions required to perform the task, for the shortest time needed. Avoid wildcards in Action and Resource. Review permissions quarterly. Use Access Analyzer to find unused permissions.

Question 25

How would you migrate 50 IAM users with access keys to Identity Center?

Accepted Answer

Phase 1: stand up Identity Center, connect IdP, create permission sets mirroring current access. Phase 2: pilot with one team, decommission their access keys. Phase 3: rollout by team. Phase 4: delete remaining access keys, enforce SCP blocking new key creation.