Question

You are setting out IAM policies for allowing users access to objects in an S3 bucket. You have configured an IAM policy for testing which currently works as intended. You try to create a more restrictive policy but find out that the changes are not working as intended. What can you do to resolve the issue in the EASIEST way possible?

A. Delete the current version of the IAM policy and recreate the older one.

B. Revert back to the previous version of the IAM policy.

C. Recreate the IAM users again.

D. Use the recycle bin to get the deleted IAM policies back.

Answer 1

Answer - B.

The AWS Documentation mentions the following.

You create a customer-managed policy that allows users to administer a particular Amazon S3 bucket using the AWS Management Console.

Upon creation, your customer-managed policy has only one version, identified as v1, so that version is automatically set as the default.

The policy works as intended.

Later, you update the policy to add permission to administer a second Amazon S3 bucket.

IAM creates a new version of the policy, identified as v2, that contains your changes.

You set version v2 as the default, and a short time later, your users report that they lack permission to use the Amazon S3 console.

In this case, you can roll back to version v1 of the policy, which you know works as intended.

To do this, you set version v1 as the default version.

Your users are now able to use the Amazon S3 console to administer the original bucket.

Because the AWS Documentation clearly mentions this, all other options are invalid.

For more information on the Amazon Container Service, please refer to the below URL-

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html

The easiest way to resolve the issue of a more restrictive IAM policy not working as intended is to revert back to the previous version of the IAM policy (option B).

When you create a new version of an IAM policy, the previous version is automatically saved, which allows you to easily revert back to the previous version if needed.

To revert back to the previous version of an IAM policy:

1. Navigate to the IAM console.
2. Click on "Policies" in the left-hand menu.
3. Select the policy in question.
4. Click on the "Versions" tab.
5. Find the previous version you want to revert to and click "Make default version."
6. Verify that the previous version is now the default version by checking the "Version ID" column.

By reverting back to the previous version, you can ensure that the previous, working policy is in place while you troubleshoot the issue with the more restrictive policy. Once you have identified and fixed the issue, you can create a new version of the policy with the necessary changes.