Design Secure Architectures

Review questions

Module summary: Design Secure Architectures

For cross-account access, locate the first failed request. AssumeRole requires source permission and target trust; the temporary session then needs the requested action on the correct resource ARN. An SCP is a ceiling, not a grant. Valid trust cannot repair a wrong object ARN or missing KMS authorization. Test an in-scope object, an out-of-scope object, and a denied write so one successful request does not masquerade as proof of least privilege.

In networking, separate client-to-ALB, ALB-to-app, and app-to-database flows. For each hop identify the initiator, port, route, and target security group. An S3 gateway endpoint supplies a private path through associated route tables but does not replace IAM, bucket, or endpoint authorization. Place WAF at a suitable HTTP entry point and retain application-level validation and authorization.

For data protection, combine encryption with permission to use the key and evidence that restore works. Copying ciphertext across accounts does not prove the recovery role can decrypt it. Restore a chosen version, verify contents, measure its age, and compare with the data-loss objective. Logical deletion or corruption may replicate to another location, so protected versions or independent restore points may be needed. A different KMS key, explicit Deny, or evidenced retention requirement changes the decision; fictional case inputs are not a general legal rule.

The smallest repair assigns `AuditReaders` to `AuditView` in production, verifies provisioning there, and tests one intended read and one write that must be denied. A counterfactual changes the repair: suppose the assignment and role exist, but a custom managed policy referenced by the permission set is missing at the exact name and path in production. Run a staged paper experiment. The counterfactual matters. The solution first isolates the faulty writer so that more misleading versions are not created. The counterfactual changes the answer.

Review questions

Test your understanding with these questions. Marking and saved results are available with a free account.

Question 1An analyst role in account A may call sts:AssumeRole on a reports role in account B. The reports role allows s3:GetObject on the correct report prefix, but its trust policy names an old role rather than the analyst role. What first change addresses the failure? Add s3:PutObject to the reports role. Correct the trusted principal ARN in the reports role trust policy to the intended analyst role. Broaden s3:GetObject in the reports role to all buckets. Grant the analyst full IAM permissions in account A.
Question 2In an AWS Organizations member account, a role IAM policy allows s3:GetObject on a specified object, but an applicable SCP explicitly denies the same action. What is the request result under these facts? Allow, because the IAM policy names the resource more precisely. Allow if an administrator repeats an Allow in the SCP. Deny, because the explicit SCP Deny limits effective permissions in the member account. The decision depends only on role session duration.
Question 3An analyst successfully assumes ReadReports across two member accounts and can list the 2026/ prefix of an S3 bucket, but GetObject on an object inside it is denied. The case supplies no Deny or customer managed KMS encryption. The role policy names only ListBucket on the bucket ARN. Which correction is most precise? Add GetObject on the 2026/* object ARNs to the target role permission policy. Add GetObject on only the bucket ARN. Broaden trust to accept every role in the source account. Remove the ListBucket prefix condition to list every object.
Question 4The target role trusts an analyst and has GetObject, but the source identity lacks AssumeRole permission. What is the first repair? Grant source sts:AssumeRole on the specific target role Expand GetObject to all buckets Remove target trust conditions Add WAF
Question 5Containers in two private subnets read S3. An S3 gateway endpoint is associated with only one subnet route table, and no NAT exists. Which change gives the second subnet an S3 path without opening internet egress? Add inbound 443 to the database security group. Associate the second route table with the S3 gateway endpoint and check its policies. Grant containers s3:* on all resources without changing routes. Move all containers into the ALB public subnet.
Question 6Why does allowing inbound 5432 in a database security group not by itself prove application connectivity from another subnet? Because the security group does not configure routing, NACLs or database authorization. Because security groups are always stateless and need a separate reply rule. Because every database connection requires CloudFront. Because port 5432 is used only by S3.
Question 7A public HTTPS service needs web request protection, while clients never need direct database access. Which boundary design fits? Public ALB on 443; private containers allow ALB SG; private database allows container SG; WAF addresses HTTP risk. Open the database port to the internet and place WAF only on the ALB. Move the database into a public subnet to reduce route count. Remove application authentication because WAF handles requests.
Question 8After S3 traffic moves through a gateway endpoint, connectivity works but a bucket policy conditioned on the old public aws:SourceIp denies the requests. Which condition preserves a restriction on the client's VPC IP? Use aws:VpcSourceIp with the intended VPC IP range Remove every access condition Add a second NAT route Replace aws:SourceIp with aws:SourceVpc restricted only to the VPC ID
Question 9A role from account B can GetObject an SSE-KMS object in A, but the KMS key policy does not allow the role to use the key. What must change before retesting? Grant PutObject in B. Extend the S3 URL expiration. Permit decrypt for the named role in the key policy with corresponding cross-account IAM authorization. Disable CloudTrail logs.
Question 10What does restoring an older report copy into an isolated location demonstrate? That every production incident will take the same time. That the tested copy can be restored and read under test conditions. That replication never carries deletion. That key policy is no longer needed.
Question 11A review job uses a path other than the VPC endpoint required by an explicit Deny in an S3 bucket policy. IAM and KMS allow the read. What best explains the denial? The report exceeds a KMS size limit. The public TLS certificate expired. The job needs PutObject rather than GetObject. The bucket's explicit path condition denies the request despite other permissions.
Question 12An encrypted backup copy exists cross-account, but the source key denies the destination account decrypt. What is missing from the restore proof? Only increase reading time Remove the negative test Align KMS grants and key policy for the bounded path, then perform a restore test Rename the database without a test
Question 13An auditor sees the AuditView permission set in IAM Identity Center but only the test account appears in the portal. What is the first repair location? Widen the production S3 policy Assign the auditor group and permission set to production and verify provisioning Give the auditor the root password Lower Route 53 TTL
Question 14A permission set containing a customer managed IAM policy is assigned to a second account, but provisioning fails because that policy is absent there. What is the targeted action? Create a policy with the matching name and path in the second account, then reprovision Add a duplicate assignment for the same user Automatically replace it with AdministratorAccess Disable S3 Versioning
Question 15An auditor role is provisioned in a member account, but an applicable SCP explicitly denies the required read. Which change addresses the denial source? Only expand Identity Center permissions Create another role named Auditor Review the SCP with its owner or redesign within the guardrail Retry from the same portal session
Question 16Public traffic now enters through a CloudFront distribution, while the existing AWS WAF protection is attached only to the origin ALB. The team wants request inspection at the distribution before origin access. Which protection configuration fits? Move the ALB's REGIONAL web ACL unchanged onto CloudFront Create a CLOUDFRONT-scope web ACL and associate it with the distribution, checking origin bypass Keep the ALB's regional web ACL and forward the client IP through CloudFront, assuming inspection now occurs at the distribution Add a private route table instead of inspecting HTTP
Question 17A trial WAF rule matches both an injection request and a legitimate checkout name containing a quote. What should happen before blocking? Enable Block immediately because one sample is malicious Move the database to a public subnet Inspect samples and refine the condition in Count, then test completed checkout Remove HTTPS
Question 18A web ACL protects the ALB, but the database still accepts direct internet connections. What gap remains? None; WAF inspects all VPC traffic The ALB needs more disk The database needs a broader IAM policy Direct database traffic bypasses HTTP inspection; restrict database ingress to the service
Question 19An operator adds a delete marker above an S3 version protected by Object Lock during retention. What follows? The protected version is permanently gone The current key may appear deleted while the protected version remains addressable by version ID Versioning automatically stops KMS decryption is guaranteed
Question 20An organization will replicate locked objects to a second bucket. Which Object Lock design condition matters? Disable destination Versioning Rely only on the object key without replication state Enable Object Lock at the destination and verify permissions for retention and legal-hold metadata Treat replication as always instantaneous
Question 21An encrypted invoice version reached the recovery Region, but the KMS key policy denies the recovery team decrypt. What is the verdict? Replication alone proves complete recovery Remove Object Lock to bypass KMS Expand only s3:ListBucket The bytes exist, but recovery is unproved until key access is corrected and decryption tested