Advanced AWS IAM: Cross-Account Access u0026 Federation Quiz Quiz

Challenge your understanding of cross-account access and identity federation within AWS IAM by answering questions on trust policies, roles, external identities, and secure delegation. Perfect for those seeking clarity on access management and federated authentication best practices.

1. Delegating Permissions Across Accounts

   If an organization wishes to allow users from Account A to access resources in Account B without creating user accounts in Account B, which IAM feature should they primarily use?

   1. IAM Groups with attached policies
   2. IAM Roles with cross-account trust
   3. Federation tokens only
   4. Resource-based policies on IAM users

   Explanation: IAM Roles with cross-account trust allow users from Account A to assume permissions in Account B without requiring duplicate user accounts. IAM Groups are used within a single account and cannot span accounts. Federation tokens are used for identity federation, not specifically for cross-account access. Resource-based policies cannot be attached directly to IAM users. Only roles with trust relationships enable secure delegation across accounts.

2. Trust Policy Scenario

   Which statement accurately describes the purpose of a trust policy in the context of cross-account IAM roles?

   1. It defines password complexity requirements.
   2. It sets the permissions granted to the role once assumed.
   3. It specifies who is allowed to assume the role.
   4. It encrypts communication between accounts.

   Explanation: A trust policy in an IAM role defines which entities (users, roles, accounts) are permitted to assume or use that role. The permissions granted after assuming the role are set by the permissions policy, not the trust policy. Communication encryption is handled elsewhere, and password complexity is managed by authentication settings, not trust policies.

3. Federation Use Case

   When an enterprise wants its employees to access AWS resources using their existing company login credentials from a different identity provider, what AWS feature enables this integration?

   1. Inline permissions boundaries
   2. Cross-region replication
   3. Identity Federation
   4. Multi-factor authentication

   Explanation: Identity federation allows users to access resources using credentials from external identity providers, such as corporate directories. Cross-region replication deals with copying resources between regions. Multi-factor authentication adds an extra layer of security but does not integrate external identities on its own. Inline permissions boundaries are unrelated to authentication sources.

4. Temporary Security Credentials

   What is the primary benefit of providing temporary security credentials via identity federation for external users?

   1. It bypasses authentication requirements.
   2. It allows unlimited access to all resources.
   3. It limits access duration and reduces exposure risk.
   4. It permanently saves the user credentials in the system.

   Explanation: Temporary security credentials restrict the time window in which users can access resources, minimizing security risks. These credentials do not provide unlimited access or permanent storage. Authentication is still required, so it does not bypass necessary security checks.

5. AssumeRole Permission Requirement

   In a cross-account scenario, which permission must an external user or role have to assume a role in another account?

   1. sts:AssumeRole
   2. s3:ListBucket
   3. ec2:RunInstances
   4. iam:UpdateUser

   Explanation: The permission sts:AssumeRole is mandatory to allow an entity to assume a role in a different account during cross-account access. s3:ListBucket provides object listing, not role assumption. iam:UpdateUser and ec2:RunInstances are unrelated to cross-account role assumption.

6. External ID Purpose

   Why is specifying an external ID in a cross-account IAM role trust policy considered a best practice?

   1. It increases the session duration automatically.
   2. It allows passwordless access by external users.
   3. It prevents the confused deputy problem by adding an extra verifier.
   4. It encrypts all incoming identity tokens.

   Explanation: The external ID prevents unintended delegation by ensuring only the trusted party can assume the role. It does not handle encryption, session duration, or passwordless authentication; those are managed through other mechanisms or configurations.

7. Permissions Policy in Cross-Account Roles

   Within a cross-account access setup, what does the permissions policy attached to the role control?

   1. Actions the role can perform on AWS resources
   2. Communication between virtual networks
   3. Which external accounts can use the role
   4. The minimum password length for users

   Explanation: The permissions policy dictates what actions and resources the role can access after being assumed. Which accounts can use the role are set in the trust policy. Connectivity between networks and password settings are defined elsewhere and are unrelated to role permissions policies.

8. OIDC Federated Access

   Which protocol allows integrating third-party identity providers for web-based single sign-on into AWS resources?

   1. VPN tunneling
   2. SMTP
   3. OpenID Connect (OIDC)
   4. ICMP

   Explanation: OpenID Connect (OIDC) is used for web-based single sign-on with external identity providers. SMTP is related to email, VPN tunneling handles secure network connections, and ICMP is a diagnostic networking protocol. Only OIDC is designed for federated identity access.

9. Account Identifier in Cross-Account Access

   When setting up cross-account IAM trust, which value must match the trusted account to permit valid access?

   1. Resource region in the permissions policy
   2. The IP address range of the user
   3. Password age for IAM users
   4. AWS account ID in the trust policy

   Explanation: The AWS account ID in the trust policy must match the account permitted to assume the role. IP ranges and password settings are not used for identifying trusted accounts. Resource regions define where resources exist, not which accounts can assume a role.

10. Revoking Federated User Access

    What should you do to immediately revoke federated users’ access who obtained temporary credentials via identity federation?

    1. Increase their policy permissions
    2. Invalidate or delete the temporary security credentials
    3. Reset their multi-factor authentication device
    4. Change the user’s email address

    Explanation: Revoking or expiring temporary security credentials ends the federated user's session immediately. Changing the email address or resetting multi-factor devices does not end active sessions. Increasing permissions would actually expand, not restrict, access.