AWS SDK and API

Question 1

Should you provide your aws_secret_access_key and aws_access_key_id in your application code

Answer 1

No. SDK credentials should be stored outside of your code

Question 2

There are 3 places where your aws_secret_access_key and aws_access_key_id can be stored for your application to access - what are they?

Answer 2

Programming Language parameter store
local files (~./aws)
environment variables

Question 3

When you make API calls to AWS services, for most services those requests are directed at a specific endpoint that corresponds to which of the following?

• AWS Facility
• AWS Region
• AWS AZ
• AWS edge location

Answer 3

AWS region - you choose a regional API endpoint either from your default configuration or by explicitly setting a location for you API client.

Question 4

You make an API request to Polly to list the voices offered and you recieve the following error:

Unable to connect to endpoint URL:
httpsL//polly.us-east-1a.amazon.aws.com/voices

Why?

Answer 4

us-east-1a is an AZ, not a region, and API calls are made to the region, not the AZ.

Question 5

The principals who have access to ASSUME an IAM role are defined in which document?

• IAM Access Policy
• IAM Trust Policy
• MS Grant Token
• AWS Credentials File

Answer 5

The IAM trust policy defines the principals who can request role credentials from AWS STS.

Question 6

API’s within AWS are rate limited, i.e. S3 has a limit of 5500 GET requests per second. What should you do if you are getting:

• Intermittent Errors
• Consistent Errors

Due to rate limiting?

Answer 6

If you are getting intermittent errors, this is probably due to spikes in load so exponential back off will likely resolve. If the errors are consistent, you probably need to request that the rate limits are raised.

Question 7

What sort of exception gets thrown if you have hit a rate limit?

Answer 7

ThrottlingException

Question 8

What is exponential backoff?

Answer 8

Simply - -every time time you retry a request, you double the amount of time you wait before issuing the request again

Question 9

For exponential back off - what do you need to do if you are developing through the SDK?

Answer 9

Nothing, Exponential back off is built into the SDK - but if your are interacting with the API as-is outside of the SDK then you will need to build it in yourself.

Question 10

When using either the AWS SDK what member of the Credentials Provider Chain has precedent over all others?

Answer 10

Environment variables have precedent over all other items in the credential provider chain for the SDK.

Question 11

What is the Credentials Provider Chain

Answer 11

The credentials provider chain is the order in which AWS will look for credentials, starting with Command line Arguments then Environment Variables and finishing with instance provider credentials (the lowest precedent). This means that credentials and their assigned permissions at a higher level will over-ride those at a lower level.

Question 12

You are developing an application within AWS. Should you store your AWS credentials in code?

Answer 12

No. Never. When working in AWS credentials should ALWAYS be inherited from the credentials chain - as we are in AWS then we can leverage IAM (i.e. Instance roles for an EC2 instance, ECS roles for ECS taskes, lambda roles for lambda tasks)

Question 13

We are building an application outside of AWS and we need to be able to pass credentials to access AWS services, what is the best practice for this?

Answer 13

Use of environment variables and or named profiles (i.e. CLI profiles)

Question 14

what is sigv4 used for?

Answer 14

Sigv4 is used for signing requests made to the AWS http API.

Question 15

SigV4 can be sent to AWS in two ways - what are they? (hint - think of the structure of an HTTP request)

Answer 15

SigV4 can be sent either within a requests header or as a query string (in the case of S3)

Question 16

When using the AWS SDK or CLI, what do you need to do to sign requests made to AWS?

Answer 16

Nothing, SigV4 is built into the CLI and SDK for you. If you are using something other than these, you will need to implement SigV4 yourself.

Question 17

What are the two things used to sign a request for SigV4? (Hint: keys)

Answer 17

Access Key and Secret Access Key

Question 18

I’d like to deploy an application to an on premise server. The server needs to perform API calls to S3. What is the most secure way of achieving this?

Answer 18

Create an IAM user for the application and put the credentials into environment variables.

Question 19

Can an EC2 instance retrieve the IAM policy JSON document that’s attached to them using the CLI with no role attached?

Answer 19

No. You can retrieve the role NAME but not the JSON document

Question 20

When using the CLI, what is the FIRST provider in the credentials provider chain?

Answer 20

Command line options are the first, and highest precedent provider in the CLI

Question 21

When using the SDK, what is the FIRST provider in the credentials provider chain?

Answer 21

Environment variables are the first and highest precedent provider for the SDK

Question 22

For both the SDK and the CLI, what is the LOWEST precedent provider in the credentials provider chain?

Answer 22

Instance Profile Credentials