AWS Security & Encryption

Question 1

KMS can only help in encrypting up to ___ of data per call

Answer 1

4KB

Question 2

What does STS do?

Answer 2

• Allows to grant limited and temporary access to AWS resources.

Question 3

Token is valid for how long?

Answer 3

1 hour

Question 4

Explain what Cross Account Access is

Answer 4

Allows users from one AWS account access resources in another
• Define an IAM Role for another account to access
• Define which accounts can access this IAM Role
• Use AWS STS (Security Token Service) to retrieve credentials and impersonate the IAM Role you have access to (AssumeRole API)
• Temporary credentials can be valid between 15 minutes to 1 hour

Question 5

What’s Identity Federation?

Answer 5

Federation lets users outside of AWS to assume temporary role for accessing AWS resources.

Federation assumes a form of 3rd party
• Microsoft Active Directory (~= SAML) 
• Single Sign On
• Open ID
• Cognito

Using federation, you don’t need to create IAM users (user management is outside of AWS)

Question 6

Goal of Cognito?

Answer 6

Provide direct access to AWS Resources from

the Client Side