Section 10: AWS CLI, SDK, IAM Roles and Policies

Question 1

My EC2 Instance does not have the permissions to perform an API call PutObject on S3. What should I do?
A) I should run ‘aws configure’ and insert my personal credentials, because I have access to PutObject on S3
B) I should ask an administrator to attach a Policy to the IAM Role on my EC2 instance that authorises it to do the API call
C) I should export the environment variables with my creditials on the EC2 instance
D) I should use the EC2 Metadata API call

Answer 1

B) I should ask an administrator to attach a Policy to the IAM Role on my EC2 instance that authorises it to do the API call

IAM roles are the right way to provide credentials and permissions to an EC2 instance

Question 2

I have an on-premise personal server that I’d like to use to perform AWS API calls
A) I should run ‘aws configure’ and put my credentials there. Invalidate them when I’m done
B) I should attach an EC2 IAM role to my personal server

Answer 2

A) I should run ‘aws configure’ and put my credentials there. Invalidate them when I’m done

Even better would be to create a user specifically for that one on-premise server

Question 3

I need my colleagues help to debug my code. When he runs the application on his machine, it’s working fine, whereas I get API authorization exceptions. What should I do?

A) Send him my AWS access key and secret key so he can replicate the issue on his machine
B) Ask him to send me his credentials so I can start working
C) Compare his IAM policy and my IAM policy in the policy simulator to understand the differences
D) Ask him to create an EC2 server and puts his credentials there so I can run the application from the EC2 instance

Answer 3

C) Compare his IAM policy and my IAM policy in the policy simulator to understand the differences

Question 4

To get the instance id of my EC2 machine from the EC2 machine, the best thing is to…
A) Create an IAM role and attach it to my instance so I can perform a “describe” API call
B) Query the user data at http://169.254.169.254/latest/user-data
C) Query the user data at http://169.254.169.254/latest/meta-data
D) Query the user data at http://254.169.254.169/latest/meta-data

Answer 4

C) Query the user data at http://169.254.169.254/latest/meta-data