Identity and Access Management & S3 Flashcards
You are a solutions architect who works with a large digital media company. The company has decided that they want to operate within the Japanese region and they need a bucket called “testbucket” set up immediately to test their web application on. You log in to the AWS console and try to create this bucket in the Japanese region however you are told that the bucket name is already taken. What should you do to resolve this?
Bucket names are global, not regional. This is a popular bucket name and is already taken. You should choose another bucket name.
What is the minimum file size that I can store on S3?
0 bytes
S3 has eventual consistency for which HTTP Methods?
overwrite PUTS and DELETES
How many S3 buckets can I have per account by default?
100
What does S3 stand for?
Simple Storage Service
Which of the following options allows users to have secure access to private files located in S3?
CloudFront Origin Access Identity
Public S3 buckets
CloudFront Signed URLs
CloudFront Signed Cookies
CloudFront Origin Access Identity
CloudFront Signed URLs
CloudFront Signed Cookies
Why is this correct?
There are three options in the question which can be used to secure access to files stored in S3 and therefore can be considered correct. Signed URLs and Signed Cookies are different ways to ensure that users attempting access to files in an S3 bucket can be authorised. One method generates URLs and the other generates special cookies but they both require the creation of an application and policy to generate and control these items. An Origin Access Identity on the other hand, is a virtual user identity that is used to give the CloudFront distribution permission to fetch a private object from an S3 bucket. Public S3 buckets should never be used unless you are using the bucket to host a public website and therefore this is an incorrect option.
There are three options in the question which can be used to secure access to files stored in S3 and therefore can be considered correct. Signed URLs and Signed Cookies are different ways to ensure that users attempting access to files in an S3 bucket can be authorised. One method generates URLs and the other generates special cookies but they both require the creation of an application and policy to generate and control these items. An Origin Access Identity on the other hand, is a virtual user identity that is used to give the CloudFront distribution permission to fetch a private object from an S3 bucket. Public S3 buckets should never be used unless you are using the bucket to host a public website and therefore this is an incorrect option.
There are three options in the question which can be used to secure access to files stored in S3 and therefore can be considered correct. Signed URLs and Signed Cookies are different ways to ensure that users attempting access to files in an S3 bucket can be authorised. One method generates URLs and the other generates special cookies but they both require the creation of an application and policy to generate and control these items. An Origin Access Identity on the other hand, is a virtual user identity that is used to give the CloudFront distribution permission to fetch a private object from an S3 bucket. Public S3 buckets should never be used unless you are using the bucket to host a public website and therefore this is an incorrect option.
One of your users is trying to upload a 7.5GB file to S3. However, they keep getting the following error message: “Your proposed upload exceeds the maximum allowed object size.”. What solution to this problem does AWS recommend?
Design your application to use the Multipart Upload API for all objects.
AWS S3 has four different URLs styles that it can be used to access content in S3. The Virtual Hosted Style URL, the Path-Style Access URL, the Static web site URL, and the Legacy Global Endpoint URL. Which of these represents a correct formatting of the Virtual Hosted Style URL style
https: //s3.us-west-2.amazonaws.com/my-bucket/slowpuppy.tar
https: //my-bucket.s3.us-west-2.amazonaws.com/fastpuppy.csv
https: //my-bucket.amazonaws.com/lazycat.docx
http: //my-bucket.s3-website.us-east-2.amazonaws.com/index.htm
http: //my-bucket.s3-website-ap-southeast-2.amazonaws.com/index.php
https: //www.my-registered-domain-guru/index.html
https://my-bucket.s3.us-west-2.amazonaws.com/fastpuppy.csv
Virtual style puts your bucket name 1st, s3 2nd, and the region 3rd. Path style puts s3 1st and your bucket as a sub domain. Legacy Global endpoint has no region. S3 static hosting can be your own domain or your bucket name 1st, s3-website 2nd, followed by the region. AWS are in the process of phasing out Path style, and support for Legacy Global Endpoint format is limited and discouraged. However it is still useful to be able to recognize them should they show up in logs.
What is the availability of S3-OneZone-IA?
99.50%
OneZone-IA is only stored in one Zone. While it has the same Durability, it may be less Available than normal S3 or S3-IA.
You work for a busy digital marketing company who currently store their data on-premise. They are looking to migrate to AWS S3 and to store their data in buckets. Each bucket will be named after their individual customers, followed by a random series of letters and numbers. Once written to S3 the data is rarely changed, as it has already been sent to the end customer for them to use as they see fit. However, on some occasions, customers may need certain files updated quickly, and this may be for work that has been done months or even years ago. You would need to be able to access this data immediately to make changes in that case, but you must also keep your storage costs extremely low. The data is not easily reproducible if lost. Which S3 storage class should you choose to minimize costs and to maximize retrieval times?
S3 - IA
The need for immediate access is an important requirement along with cost. Glacier has a long recovery time at a low cost or a shorter recovery time at a high cost, and 1Zone-IA has a lower Availability level which means that it may not be available when needed.
S3 has what consistency model for PUTS of new objects
Read After Write Consistency
You have been asked to set up a recovery process that generates the lowest possible cost for retrieving information from Glacier. There is petabytes of information that need to be retrieved if this process is to be enacted. Which retrieval option would allow you to achieve this?
Bulk
Cost of retrieval of information from Glacier can go up dependent on how quickly you require the data and how much data is to be retrieved. Expedited retrievals allow you to quickly access your data stored in the S3 Glacier storage class when occasional urgent requests for a subset of archives are required, but at the highest cost. Standard retrievals allow you to access any of your archived objects within several hours, this is faster than bulk (averaging around 12 hours) but more expensive. Bulk retrievals are the lowest-cost retrieval option in Amazon S3 Glacier, enabling you to retrieve large amounts, even petabytes, of data inexpensively.
What is the availability of objects stored in S3?
99.99%
You run a meme creation website where users can create memes and then download them for use on their own sites. The original images are stored in S3 and each meme’s metadata in DynamoDB. You need to decide upon a low-cost storage option for the memes, themselves. If a meme object is unavailable or lost, a Lambda function will automatically recreate it using the original file from S3 and the metadata from DynamoDB. Which storage solution should you use to store the non-critical, easily reproducible memes in the most cost-effective way?
S3 - 1Zone-IA
You run a popular photo-sharing website that depends on S3 to store content. Paid advertising is your primary source of revenue. However, you have discovered that other websites are linking directly to the images in your buckets, not to the HTML pages that serve the content. This means that people are not seeing the paid advertising, and you are paying AWS unnecessarily to serve content directly from S3. How might you resolve this issue?
Remove the ability for images to be served publicly to the site and then use signed URLs with expiry dates.
You work for a major news network in Europe. They have just released a new mobile app that allows users to post their photos of newsworthy events in real-time, which are then reviewed by your editors before being copied to your website and made public. Your organization expects this app to grow very quickly, essentially doubling its user base each month. The app uses S3 to store the images, and you are expecting sudden and sizable increases in traffic to S3 when a major news event takes place (as users will be uploading large amounts of content.) You need to keep your storage costs to a minimum, and it does not matter if some objects are lost. With these factors in mind, which storage media should you use to keep costs as low as possible?
S3 - One Zone-Infrequent Access
The key driver here is cost, so an awareness of cost is necessary to answer this. Full S3 is quite expensive at around $0.023 per GB for the lowest band. S3 standard IA is $0.0125 per GB, S3 One-Zone-IA is $0.01 per GB, and Legacy S3-RRS is around $0.024 per GB for the lowest band. Of the offered solutions SS3 One-Zone-IA is the cheapest suitable option. Glacier cannot be considered as it is not intended for direct access, however it comes in at around $0.004 per GB. Of course you spotted that RRS is being deprecated, and there is no such thing as S3 - Provisioned IOPS. In this case OneZone IA should be fine as users will ‘post’ material but only the organization will access it and only to find relevant material. The question states that there is no concern if some material is lost.
What is Amazon Glacier?
An AWS service designed for long term data archival.
You have been asked to advise on a scaling concern. The client has an elegant solution that works well. As the information base grows they use CloudFormation to spin up another stack made up of an S3 bucket and supporting compute instances. The trigger for creating a new stack is when the PUT rate approaches 100 PUTs per second. The problem is that as the business grows that number of buckets is growing into the hundreds and will soon be in the thousands. You have been asked what can be done to reduce the number of buckets without changing the basic architecture.
Change the trigger level to around 3000 as S3 can now accommodate much higher PUT and GET levels.
Until 2018 there was a hard limit on S3 puts of 100 PUTs per second. To achieve this care needed to be taken with the structure of the name Key to ensure parallel processing. As of July 2018 the limit was raised to 3500 and the need for the Key design was basically eliminated. Disk IOPS is not the issue with the problem. The account limit is not the issue with the problem.
You work for a health insurance company that amasses a large number of patients’ health records. Each record will be used once when assessing a customer, and will then need to be securely stored for a period of 7 years. In some rare cases, you may need to retrieve this data within 24 hours of a claim being lodged. Given these requirements, which type of AWS storage would deliver the least expensive solution?
Glacier
The recovery rate is a key decider. The record shortage must be; safe, durable, low cost, and the recovery can be slow. All features of Glacier.
Which of the following is not a feature of IAM?
IAM allows you to set up biometric authentication, so that no passwords are required.
IAM offers fine-grained access control to AWS resources.
IAM offers centralized control of your AWS account.
IAM integrates with existing active directory account allowing single sign-on.
IAM allows you to set up biometric authentication, so that no passwords are required.
In what language are policy documents written?
JSON
An application you are working on has a new app. The development team for this app requires access to a bucket that is located within your team’s aws account. The other team requires programmatic and console level access to your team’s bucket. How would you share this bucket with this other team’s account?
Setting up a cross account IAM Role
Setting up a cross account IAM role is currently the only method that will allow IAM users to access cross account S3 buckets both programmatically and via the AWS console.
You have a client who is considering a move to AWS. In establishing a new account, what is the first thing the company should do?
Set up an account using their company email address.
You are a developer at a fast-growing startup. Until now, you have used the root account to log in to the AWS console. However, as you have taken on more staff, you will need to stop sharing the root account to prevent accidental damage to your AWS infrastructure. What should you do so that everyone can access the AWS resources they need to do their jobs?
Create a customized sign-in link such as “yourcompany.signin.aws.amazon.com/console” for your new users to use to sign in with.
Give your users the root account credentials so that they can also sign in.
Create an additional AWS root account for each new user.
Create individual user accounts with minimum necessary rights and tell the staff to log in to the console using the credentials provided.
Create a customized sign-in link such as “yourcompany.signin.aws.amazon.com/console” for your new users to use to sign in with.
Create individual user accounts with minimum necessary rights and tell the staff to log in to the console using the credentials provided.
Which statement best describes IAM?
IAM allows you to manage permissions for AWS resources only.
IAM allows you to manage users’ passwords only. AWS staff must create new users for your organization. This is done by raising a ticket.
IAM allows you to manage users, groups, roles, and their corresponding level of access to the AWS Platform.
IAM stands for Improvised Application Management, and it allows you to deploy and manage applications in the AWS Cloud.
AM allows you to manage users, groups, roles, and their corresponding level of access to the AWS Platform.
Power User Access allows ____.
Access to all AWS services except the management of groups and users within IAM.
Every user you create in the IAM systems starts with ____.
No Permissions
You are a security administrator working for a hotel chain. You have a new member of staff who has started as a systems administrator, and she will need full access to the AWS console. You have created the user account and generated the access key id and the secret access key. You have moved this user into the group where the other administrators are, and you have provided the new user with their secret access key and their access key id. However, when she tries to log in to the AWS console, she cannot. Why might that be?
You cannot log in to the AWS console using the Access Key ID / Secret Access Key pair. Instead, you must generate a password for the user, and supply the user with this password and your organization’s unique AWS console login URL.
What is an additional way to secure the AWS accounts of both the root account and new users alike?
Implement Multi-Factor Authentication for all accounts.
A __ is a document that provides a formal statement of one or more permissions.
Policy
Which of the following is not a component of IAM?
Roles
Users
Organizational Units
Groups
Organizational Units
What is the default level of access a newly created IAM User is granted?
No access to any AWS services.
When you create a new user, that user ____.
Will be able to interact with AWS using their access key ID and secret access key using the API, CLI, or the AWS SDKs assuming programmatic access was enabled.
Will be able to log in to the console only after multi-factor authentication is enabled on their account.
Will only be able to log in to the console in the region in which that user was created.
Will be able to log in to the console anywhere in the world, using their access key ID and secret access key.
Will be able to interact with AWS using their access key ID and secret access key using the API, CLI, or the AWS SDKs assuming programmatic access was enabled.
A new employee has just started work, and it is your job to give her administrator access to the AWS console. You have given her a user name, an access key ID, a secret access key, and you have generated a password for her. She is now able to log in to the AWS console, but she is unable to interact with any AWS services. What should you do next?
Grant her Administrator access by adding her to an Administrators’ group.
You have created a new AWS account for your company, and you have also configured multi-factor authentication on the root account. You are about to create your new users. What strategy should you consider in order to ensure that there is good security on this account.
Enact a strong password policy: user passwords must be changed every 45 days, with each password containing a combination of capital letters, lower case letters, numbers, and special symbols.
What level of access does the “root” account have?
Administrator Access
You are a solutions architect working for a large engineering company that are moving from a legacy infrastructure to AWS. You have configured the company’s first AWS account and you have set up IAM. Your company is based in Andorra, but there will be a small subsidiary operating out of South Korea, so that office will need its own AWS environment. Which of the following statements is true?
You will then need to configure Users and Policy Documents for each region, respectively.
You will need to configure your policy documents regionally, however your users are global.
You will need to configure your users regionally, however your policy documents are global.
You will need to configure Users and Policy Documents only once, as these are applied globally.
You will need to configure Users and Policy Documents only once, as these are applied globally.
In terms of IAM, what are Users?
End users such as people, employees of an organization, etc
In terms of IAM, what are Groups?
A collection of users. Each user in the group will inherit the permissions of the group.
In terms of IAM, what are Policies?
Polices are made up of documents, called Policy documents. These documents are in a format called JSON and they give permissions as to what a User/Group/Role is able to do.
In terms of IAM, what does an Object consist of?
Consists of kay&value, version ID, metadata, and various sub-resources such as access control lists and torrents.
Define IAM
Identity and Access Management is a global AWS service allows you to manage user and their level of access to the AWS Console.
- Centralized control of your AWS account
- Shared Access to your AWS account
- Granular Permissions
- Identity Federation
- Multi-factor Authentication
- Provide temporary access for users/devices and services where necessary
- allows you to set up your own password rotation policy
- integrates with many different AWS services
- Supports PCI DSS Compliance (CC transactions)
S3 Standard Storage Features
99.9(11x9) durability, stored redundantly across multiple devices in multiple facility, and is designed to sustain the loss of 2 facilities concurrently.
S3 IA Storage is best used for:
Infrequently accessed - for data that is accessed less frequently, but requires rapid access when needed. lower fee than S3, but you are charged a retrieval fee.
S3 One Zone - IA Storage is best used for:
For where you want a lower-cost option for infrequently accessed data, but do not require the multiple availability zone data resilience.
