Permission Boundaries Quiz

What you'll be asked

1. What is the primary purpose of an IAM permission boundary?
2. If an IAM user has an identity-based policy allowing 's3:*' but a permission boundary that only allows 's3:ListBucket', what is the effective permission?
3. Which of the following statements is true regarding how permission boundaries interact with SCPs (Service Control Policies)?
4. An IAM user has an identity-based policy that denies 's3:DeleteBucket'. The user also has a permission boundary that allows 's3:*'. What is the result of a request to delete a bucket?
5. You want to delegate the ability to create IAM users to a junior administrator but ensure they cannot grant themselves or others more permissions than they currently have. How do you achieve this?

Answers and explanations come after you submit.