IAM Permissions Boundaries for AWS Security

• ✓ A.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:DeleteBucket","Resource":"*"}]}
• B.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"s3:ListAllMyBuckets","Resource":"*"}]}
• C.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:ListAllMyBuckets","s3:DeleteBucket"],"Resource":"*"}]}
• D.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Allow","Action":"s3:DeleteBucket","Resource":"*"}]}

Why A: Permissions boundaries set the maximum permissions for an IAM role. For the role to be able to list S3 buckets, the boundary must include an explicit Allow for s3:ListAllMyBuckets. To ensure the role cannot delete buckets, the boundary must include an explicit Deny for s3:DeleteBucket. Option A contains both the necessary Allow and the explicit Deny, meeting the requirement. Option B denies s3:ListAllMyBuckets, which would prevent listing. Option C allows both actions, which would allow deletion. Option D also allows both actions. Therefore, Option A is the correct permissions boundary.

• A.The EC2 instance must have an instance profile attached.
• ✓ B.The effective permissions are the intersection of the boundary and identity-based policies.
• ✓ C.The identity-based policy attached to the role must allow the required actions.
• ✓ D.The permissions boundary policy must allow the required actions.
• E.The S3 bucket policy must explicitly allow the role.

Why B: Options B, C, and D are correct. When a permissions boundary is applied to a role, effective permissions are the intersection of the boundary policy and the identity-based policy. Therefore, both the identity-based policy (C) and the boundary policy (D) must allow the required actions. Option B correctly describes this intersection. Option A is incorrect because an instance profile is necessary for EC2 to assume a role but is not a condition for the role's effective permissions themselves. Option E is incorrect because while a bucket policy can grant or deny access, it is not a required condition; the role's effective permissions are determined by the identity-based and boundary policies.

• A.Permissions boundaries can be applied to service-linked roles.
• B.Permissions boundaries can only be applied to IAM users, not roles.
• ✓ C.The effective permissions are the intersection of the identity-based policy and the permissions boundary.
• D.Permissions boundaries can override resource-based policies.
• ✓ E.A permissions boundary alone does not grant permissions; an identity-based policy is also required.

Why C: The correct answers are C and E. Permissions boundaries set the maximum permissions that an identity-based policy can grant. The effective permissions are the intersection of the identity-based policy and the permissions boundary (C). A permissions boundary alone does not grant permissions; you must also attach an identity-based policy (E). Option A is incorrect because permissions boundaries cannot be applied to service-linked roles. Option B is incorrect because permissions boundaries can be applied to both IAM users and roles. Option D is incorrect because permissions boundaries do not affect resource-based policies; they only limit identity-based policies.