CLI, SDK and IAM Policies

Question 1

In the AWS CLI, how to check if we have access for a spefic command?

Answer 1

Some command supports Dry Runs with the option –dry-run

Question 2

How can you decode the error messages, what you got in CLI?

Answer 2

Use the sts-decode-authorization-message. NOTE: it needs some permission

Question 3

How can an EC2 instance get information about themself?

Answer 3

With the EC2 Insntance Metadata.
It doesn’t need any IAM role
The url is http://169.254.169.254/latest/meta-data
But it can’t retrive the attached policies.

Question 4

Can you use the MFA with CLI?

Answer 4

Yes, you must create a temp. session

Question 5

How to use MFA with CLI?

Answer 5

To get a temporary session, use the sts get-session-token command with the –serial-number of the mfa device and the –token-code that was generated by the device.

Question 6

What SDK is used for the AWS CLI?

Answer 6

The Python version of the AWS SDK.

Question 7

What are the 2 limit types for AWS CLI / SDK?

Answer 7

• API Rate Limit
• Service Quotas

Question 8

What is API Rate Limit for AWS

Answer 8

• DescribeInstances API for EC2 has a limit of 100 calls per seconds
• GetObject on S3 has a limit of 5500 GET per second per prefix
• For Intermittent Errors: implement Exponential Backoff
• For Consistent Errors: request an API throttling limit increase

Question 9

What is Service Quotas?

Answer 9

• Running On-Demand Standard Instances: 1152 vCPU
• You can request a service limit increase by opening a ticket
• You can request a service quota increase by using the Service Quotas API

Question 10

What is Exponential Backoff for any AWS Service?

Answer 10

• If you get ThrottlingException intermittently, use exponential backoff
• Must implement yourself if using the AWS API as-is or in specific cases
• Must only implement the retries on 5xx server errors and throttling
• Do not implement on the 4xx client errors

Question 11

What is the AWS CLI Credential Provider Chain order?

Answer 11

1. CMD op
2. Env. var.
3. CLI cred file
4. CLI config file
5. Container cred
6. Instance profile

Question 12

What is the AWS SDK Credential Provider Chain order?

Answer 12

1. SDK sys prop
2. Env. var.
3. Defaul cred profiles
4. Container cred
5. Instance profile

Question 13

What is the auth method for AWS services on HTTP?

Answer 13

Signing request with SigV4.

Question 14

How can you pass the SigV4 values?

Answer 14

• In HTTP headers
• In query string