AWS CLI, SDK, IAM Roles & Policies

Question 1

How can you test IAM policies quickly?

Answer 1

• Use the AWS Policy Simulator
• Use the –dry-run option in the AWS CLI

Question 2

How do you decode the CLI error message when API calls fail?

Answer 2

Use the STS command line with the following command:
- sts decode-authorization-message

Question 3

How can you access the EC2 Instance Metadata?

Answer 3

Use the following url:
http://169.254.169.254/latest/meta-data

Question 4

How would you use MFA with the CLI?

Answer 4

• Create a temporary session
• Run the STS GetSessionToken API call

Question 5

What is the default region used by the SDK if not specified?

Answer 5

us-east-1

Question 6

How would you fix intermittent errors due to hitting API rate limits?

Answer 6

Implement Exponential Backoff Retrier

Question 7

How would you fix consistent errors due to hitting API rate limits?

Answer 7

Request an API throttling limit increase

Question 8

What is the Service Limit number for Running On-Demand Standard Instances? How could you increase this limit?

Answer 8

1152 vCPUs
- Request a service limit increase by opening a ticket
- Request a service quota increase by using the Service Quotas API

Question 9

When would you implement Exponential Backoff, when would you not implement it, and how would you do so?

Answer 9

If you get ThrottlingException intermittently
- Retry mechanism already included in the SDK
- Implement retries on 5xx server errors and throttling
- Do not implement on 4xx client errors

Question 10

What is the order in which the CLI looks for credentials?

Answer 10

1. Command line options
2. Environment variables - AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN
3. CLI credentials file
4. CLI configuration file
5. Container credentials - for ECS tasks
6. Instance profile credentials - for EC2 Instance profiles

Question 11

What is the order in which the SDK looks for credentials?

Answer 11

1. Java system properties - aws.accessKeyId and aws.secretKey
2. Environment variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
3. The default credential profiles file
4. Container credentials - for ECS containers
5. Instance profile credentials - used on EC2 instances

Question 12

What is the AWS Credentials Best Practice?

Answer 12

• Never store AWS Credentials in code
• Allow credentials to be inherited from the credentials chain

Question 13

If you are working outside of AWS, what is best practice for using credentials?

Answer 13

Use env. variables / named profiles

Question 14

What does SigV4 mean?

Answer 14

Your request to AWS are signed using your credentials and are authenticated against AWS.
- Signed using the HTTP Header option or Query String option (Query String is used when viewing S3 objects)