AWS CLI, SDK, IAM Roles and Policies

Question 1

aws profiles

Answer 1

• allow you to switch between different aws accounts on the cli
• aws configure —profile <prof></prof>

Question 2

AWS CLI MFA

Answer 2

• sts getSessionToken api call
  
  • aws sts get-session-token mfa device token code duration …
• aws configure —profile mfa
  
  • set session token

Question 3

aws sdk

Answer 3

• call aws resources from inside apps
• default region: us-east-1 for aws sdk

Question 4

aws limits (quotas)

Answer 4

• rate limits
  
  • describInstances - 100 calls per second
• exponential backoff (AWS service)
  
  • use it when you get throttlingException
  • retry mechanism already included in aws sdk
  • must implement yourself is using aws api
    
    • must only implement retries on 5xx server errors

Question 5

AWS CLI Credentials provider chain

Answer 5

• command line options
• env variables
• cli credentials file
• cli configuration file
• container credentials for (ECS)
• instance profile credentials (EC2 instance profiles)

Question 6

AWS roles best practices

Answer 6

• in aws, use iam roles
  
  • ec2 instance roles for ec2 instances
  • ecs roles for ecs
  • lambda roles
• outside aws
  
  • env variables, named profiles, etc.