Security Token Service

Question 1

Security Token Service

Answer 1

allows you to grant a trusted user temporary and controlled access to AWS resources.
consist of access key and session token. user come from 3 sources: Federation(Typically Active Directory);
Federation with Mobile Apps(Google, Facebook, Open ID to login);
Cross Account Access: Let users from one AWS account access resources in another.

Question 2

Federation

Answer 2

create a trust relationship between an identity provider and aws.
User can sign into an identity provider like Amazon, facebook, Google etc.

Question 3

identity broker

Answer 3

is in charge of mapping the user to the right set of credentials.

Question 4

Identity Store

Answer 4

Facebook, Google, Amazon etc.

Question 5

Identity

Answer 5

a user or identity within an identity store.

Question 6

Temporary Credentials with EC2

Answer 6

assign an IAM role to the EC2 instance
get automatic temporary security credentials from the instance metadata using the AWS SDKs/CLI.
donot have to explicitly get credentials.

Question 7

Temporary Credentials with AWS SDKs

Answer 7

§ Call the AWS STS API (AssumeRole) with your code
§ Extract the credentials and session token, and use those values for future
calls to AWS
§ Make sure you renew credentials before the old ones expire (some SDKs do
this for you)

Question 8

Temporary Credential with APIs

Answer 8

§ Sign requests with your temporary security credentials that you get from
AWS STS
§ Use the access key ID and secret access key, and add your session token to
the API request
– Add the session token to an HTTP header
– OR add it to a query string parameter named X-AMZ-Security-Token

Question 9

A corporate web application is deployed within an Amazon VPC, and is
connected to the corporate data center via IPSec VPN. The application must
authenticate against the on-premises LDAP server. Once authenticated, loggedin
users can only access an S3 keyspace specific to the user.

Answer 9

Solution:
§ Develop an identity broker to authenticate against LDAP
§ Identity broker calls the STS API to receive temporary credentials
§ Application can then access the temporary AWS permissions

Question 10

Active Directory Federation:

Answer 10

Through SAML and AD first then sign in to AWS using AssumeRoleWithSAML API