Interview Q&A / AWS & Cloud

1. What is the difference between IAM users, groups, roles and policies in AWS?

   A user is an identity for one person or app with long-term credentials. A group is a set of users that share permissions. A role is an identity that anyone or anything trusted can assume to get temporary credentials. A policy is the JSON document that says what is allowed or denied. Grant only the permissions needed, which is least privilege.

   BeginnerIn-depth4 min read
2. How should you protect and use the AWS account root user?

   Enable MFA on the root user, do not create access keys for it, and use it only for the few tasks that need it. For daily work use IAM Identity Center or IAM users and roles with least privilege.

   BeginnerQuick answer1 min read
3. Why use an IAM role for an EC2 instance instead of storing access keys on it?

   A role gives the instance temporary credentials that AWS rotates automatically, so no long-lived secret sits on disk or in code. Access keys can leak through code repos, images or logs and stay valid until someone revokes them.

   BeginnerQuick answer1 min read
4. How does AWS decide whether a request is allowed or denied when several IAM policies apply?

   By default everything is denied. A request is allowed only if some policy explicitly allows it, and any explicit Deny in any applicable policy overrides every Allow.

   IntermediateQuick answer1 min read
5. How would you give a user read-only access to one specific S3 bucket?

   Attach an identity policy that allows s3:ListBucket on the bucket ARN and s3:GetObject on the objects inside it using the bucket ARN with /*. Nothing else is allowed, so the user can read but not write or delete.

   IntermediateQuick answer1 min read
6. How does cross-account access work with IAM roles and AWS STS?

   The target account creates a role with a trust policy naming the other account, and permissions for what the role can do. A user or service in the other account calls STS AssumeRole and receives temporary credentials for that role.

   AdvancedQuick answer1 min read