1. Introduction to AWS Flashcards
to be added later (38 cards)
all the functionality of AWS is exposed through
APIs.
Every command in AWS is fundamentally an API request
Management Console helps manage resources manually. Programmatic management of AWS resource is possible through
AWS CLI or AWS SDK. These help automate the management of resources on cloud.
The AWS CLI and the SDK on the same server can share configuration settings (like credentials, region, profiles) through files like
~/.aws/config
~/.aws/credentials
In comparison to IAM user, root user has the permissions to
- Change billing information
- Close AWS account
an AWS managed policy that grants full access to all AWS services and resources.
Administrator Access
It essentially allows performing any action (“Action”: “”), on any resource (“Resource”: “”).
Its Amazon Resource Name (ARN) is arn:aws:iam::aws:policy/AdministratorAccess.
used by the initial administrator user created after setting up an AWS a
As a separator when there is no explicit region, ARNs of AWS-managed policies have _, while ARNs of customer-managed policies have _
- ::aws
- ::123456789012 (account ID)
In ARNs, when service is global (not region-specific), _ is used as separator in ARN.
When service is global (not region-specific) and is not account-specific, then _ is used as separator in ARN.
- double colon (::)
- triple colon (:::)
Example, AWS-managed IAM Policy apply globally (not region-specific). So, their ARNs include double colon as shown below:
arn:aws:iam::aws:policy/AdministratorAccess
Example, some global AWS services (like S3 or IAM) do not require a region or account ID, leading to extra colons. So, their ARNs include triple colon as shown below:
arn:aws:s3:::my-bucket-name
arn:aws:iam:::role/MyGlobalRole
Some AWS service-linked roles and global IAM roles may omit account id
* arn:aws:iam:::role/aws-service-role/organizations.amazonaws.com/AWSServiceRoleForOrganizations
* arn:aws:iam:::role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig
To log into the management console, an IAM user needs
- Console Sign-in URL
- User Name
- Password
Access Keys of an IAM user are generated by root user.
(T/F)
True.
Go to Users Menu in IAM, select Security Credentials tab, click “Create Access Key” button.
On the final page, you will be given a chance to copy two values: the Access Key, which you can always obtain, and the Secret Access Key, which you will not see again
The command “aws configure” initiates a series of prompts for 4 values. What are they?
- Access Key ID
- Secret Access Key
- Default Region Name
- Default Output Format (json)
CLI command to confirm which identity/user the AWS CLI is currently operating as
aws iam get-user
You can also get the details specifically for the IAM user with specific name:
aws iam get-user –user-name my-application-user
The command returns a JSON object containing the user’s details.
Command to configure CLI with named profiles
aws configure –profile developer
You will be prompted for the configuration values again. From then on, you may append –profile developer to any AWS CLI command to run it as this alternate user
AWS tool to launch a CLI terminal window in your web browser
Cloud Shell
CLI command format
CLI commands are invoked in the format aws service-name command, followed by any additional parameters or flags.
To see all services, use aws help and to see all commands for a service, use aws service-name help.
list details of all S3 buckets in your account
aws s3 ls
show details of all EC2 instances in your account
aws ec2 describe-instances
What’s the purpose of signing the API request to AWS resource/service?
SDK/CLI signs any API request to add authentication information.
SDK/CLI uses your secret access key (which only you and AWS should know) to create a unique digital signature based on the entire request details (the action being called, parameters, timestamp, etc.)
This signature is sent along with your access key ID in the request
AWS receives the request, looks up the provided access key ID to find the associated secret key (which it stored when the key pair was created), and then independently calculates its own signature based on the request details it received.
Sign calculated by AWS must match sign sent with request to authenticate
API request made through SDK/CLI uses _ for authentication and _ for authorization.
- signature
- IAM policy
Only after successful authentication does AWS proceed to the authorization step. AWS then checks the policies attached to that identity.
if an api request from CLI/SDK has “access denied” error, then
the policy attached to the user does not authorize to perform action described in api request.
Difference between “403 Forbidden” and “401 Unauthorized” response of an api request to AWS
- 403 Forbidden: indicates that the server understood the request but refuses to authorize it. This is a perfect fit for an authorization failure – AWS knows who you are (authentication succeeded), but your identity does not have the necessary permissions (authorization failed)
- 401 Unauthorized: indicates that authentication failed (the server doesn’t know who you are or your credentials were invalid).
The SDK and CLI both automatically check several locations for configuration and credentials, when they are not explicitly provided in the code. These locations include
- environment variables
- programming language–specific parameter stores
- local files
Best Practice for managing credentials automatically for code running on an AWS compute environment like EC2 or Lambda
Assign an IAM role to the environment (EC2/Lambda).
This enables the SDK to load the credentials automatically from the role and to refresh the credentials as they are automatically rotated.
IAM roles provide temporary credentials for access to AWS compute environments. Give 3 examples.
- EC2InstanceRole: Used for applications running on EC2 that need access to AWS services (e.g., S3, DynamoDB).
- LambdaExecutionRole: Required for Lambda functions to interact with services like S3, DynamoDB, or SNS
- ECSTaskRole: Allows ECS tasks to access AWS services securely
temporary security credentials of an IAM role are issued by which AWS service?
AWS Security Token Service (STS)
