Answer an AWS question with one ```json code block holding exactly what the question asks for, as strict JSON. Do not include comments or explanations. All ARNs use the aws partition.
query: Return a DynamoDB Query request in the format accepted by the AWS CLI for --cli-input-json. The table Orders has partition key pk and sort key sk, both strings. Fetch the items where pk is USER#42, sk starts with ORDER#2026, and the string attribute status is SHIPPED, with the highest sort keys first.
{
"TableName": "Orders",
"KeyConditionExpression": "pk = :pkVal AND begins_with(sk, :skprefix)",
"FilterExpression": "status = :statusVal",
"ExpressionAttributeValues": {
":pkVal": { "S": "USER#42" },
":skprefix": { "S": "ORDER#2026" },
":statusVal": { "S": "SHIPPED" }
},
"ScanIndexForward": false
}
Answer an AWS question with one ```json code block holding exactly what the question asks for, as strict JSON. Do not include comments or explanations. All ARNs use the aws partition.
require-mfa: Write an IAM identity policy that allows ec2:* on all resources, except that ec2:TerminateInstances is denied unless the request was authenticated with MFA, regardless of the type of credentials the caller used.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "ec2:TerminateInstances",
"Resource": "*",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "false"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
}
]
}
Answer an AWS question with one ```json code block holding exactly what the question asks for, as strict JSON. Do not include comments or explanations. All ARNs use the aws partition.
event-pattern: Write an EventBridge event pattern that matches S3 "Object Created" events sent to EventBridge, restricted to the bucket acme-uploads, where the object key ends in .csv and the object size is greater than 0.
{
"source": ["aws.s3"],
"detail-type": ["Object Created"],
"detail": {
"bucket": {
"name": ["acme-uploads"]
},
"object": {
"key": [
{
"suffix": ".csv"
}
],
"size": [
{
"numeric": [">", 0]
}
]
}
}
}
Answer an AWS question with one ```json code block holding exactly what the question asks for, as strict JSON. Do not include comments or explanations. All ARNs use the aws partition.
home-folder: Write a single IAM identity policy to attach to multiple IAM users. Each user may list only the keys under home/<their user name>/ in the S3 bucket acme-home, and may download and upload objects only under that prefix. The policy must grant no other permissions.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowListBucket",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": "arn:aws:s3:::acme-home",
"Condition": {
"StringLike": {
"s3:prefix": [
"home/${aws:username}/"
]
}
}
},
{
"Sid": "AllowObjectAccess",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::acme-home/home/${aws:username}/*"
}
]
}
Answer an AWS question with one ```json code block holding exactly what the question asks for, as strict JSON. Do not include comments or explanations. All ARNs use the aws partition.
home-folder: Write a single IAM identity policy to attach to multiple IAM users. Each user may list only the keys under home/<their user name>/ in the S3 bucket acme-home, and may download and upload objects only under that prefix. The policy must grant no other permissions.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::acme-home",
"Condition": {
"StringLike": {
"s3:prefix": "home/${aws:username}/*"
}
}
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::acme-home/home/${aws:username}/*"
}
]
}