Section 12: AWS CLI, SDK, IAM Roles & Policies

Question 1

You want to know if you can create ec2 instances using the AWS CLI without actually creating an issue. How can you do that?

Answer 1

Pass the –dry-run flag as the first argument after the command.

Question 2

After running an AWS CLI command it returned an encrypted failure message. Which command can you use to decrypt the message?

Answer 2

STS. (Security Token Service)

Run aws sts decode-authorization-message –encoded-message <encrypted-failure-message></encrypted-failure-message>

Question 3

What is IMDS?

Answer 3

Instance Meta-Data Service.

You can request meta-data about an instance using a URL

Question 4

What is the difference between IMDS v1 and IMDS v2?

Answer 4

IMDS v1 is using a simple HTTP get request:
http://169.254.169.254/latest/meta-data

IMDS v2 takes 2 requests:

Step 1: Get a token
TOKEN=curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"

Step 2: Request meta data using the token
curl -H “X-aws-ec2-metadata-token: $TOKEN” -v http://169.254.169.254/latest/meta-data/

Question 5

What can we use the use MFA for the AWS CLI

Answer 5

aws sts get-session-token

Question 6

What will happen if we use the AWS SDK without specifying a default region?

Answer 6

It will use us-east-1

Question 7

What is exponential backoff?

Answer 7

Retry requests with exponential delays when receiving a 5xx response (ThrottlingException, due to rate limits) when calling the AWS API.

First retry after 1 second
Second retry after 2 seconds
Third retry after 4 seconds
Fourth retry after 8 seconds
…

Do not retry when receiving 4xx responses.

Question 8

In which order will the AWS CLI look for credentials? (Credentials Provider Chain)

Answer 8

1. Command line options
2. Environment variables
3. CLI credentials file (~/.aws/credentials)
4. CLI configuration file (~/.aws/config)
5. Container credentials (for ECS tasks)
6. Instance profile credentials (EC2 Instance Profile)

Question 9

In which order will the AWS SDK look for credentials? (Java)

Answer 9

1. Java system properties
2. Environment variables
3. The default credential profiles file (~/.aws/credentials)
4. Container credentials (for ECS tasks)
5. Instance profile credentials (EC2 Instance Profile)

Question 10

Which 2 options do you have to send a SigV4 signed request?

Answer 10

1. using HTTP Headers
2. using Query parameters (ex: S3 pre-signed URLs)