AWS CLI, SDK, IAM Roles & Policies Flashcards
What is the purpose of EC2 Instance Metadata?
To allow an EC2 instance to learn about itself, such as instance ID, without needing IAM permissions.
What is the URL for EC2 Instance Metadata?
http://169.254.169.254/latest/meta-data
Can you retrieve IAM policy from EC2 metadata?
No, only IAM Role name is available, not the policy.
What is the difference between metadata and user data on EC2?
Metadata is instance information; user data is a launch script run once at boot.
What is the difference between IMDSv1 and IMDSv2?
IMDSv1 allows direct metadata access; IMDSv2 requires a session token for improved security.
How do you use MFA with the AWS CLI?
Use the STS GetSessionToken API to generate temporary credentials.
What is the command to get temporary credentials using MFA in AWS CLI?
aws sts get-session-token –serial-number <mfa-arn> --token-code <code> --duration-seconds 3600</code></mfa-arn>
Which programming languages are supported by AWS SDK?
Java, .NET, Node.js, PHP, Python (boto3), Go, Ruby, C++.
Which SDK does AWS CLI use internally?
Python SDK - boto3.
What region is used by default if not configured in SDK?
us-east-1.
What is Exponential Backoff used for in AWS?
To handle intermittent throttling errors with retries after increasing delays.
What should you do for consistent API throttling?
Request a service limit increase.
What are example API rate limits in AWS?
EC2 DescribeInstances: 100 calls/sec; S3 GET: 5500 per second per prefix.
What is the AWS CLI credentials provider chain order?
- CLI options 2. Env vars 3. CLI credentials file 4. CLI config file 5. ECS container creds 6. EC2 instance profile.
What is the AWS SDK default credentials provider chain?
- Java properties 2. Env vars 3. Credentials file 4. ECS container creds 5. EC2 instance profile.
In a scenario where environment variables are used on an EC2 instance, why might it override instance profile permissions?
Because environment variables have higher priority in the credentials provider chain.
What is the top AWS credential management best practice?
Never store AWS credentials in your code.
How should credentials be managed inside AWS?
Use IAM roles: EC2 roles, Lambda roles, ECS roles.
How should credentials be managed outside AWS?
Use environment variables or named profiles.
What is SigV4 in AWS?
It’s the signing process used to authenticate AWS HTTP requests.
When do you need to manually use SigV4?
When making direct HTTP API calls without the SDK or CLI.
Do AWS CLI and SDK sign requests automatically with SigV4?
Yes, they handle the signing process automatically.
What is a subnet?
A partition of a VPC’s network; tied to an Availability Zone.
