Security

Question 1

AWS Systems Manager Parameter Store

Answer 1

• Secure storage for configuration data management and secrets management
• Store passwords, DB strings, license code as parameter values
• Plain text or encrypted data
• more cost effective than AWS secrets manager

Question 2

AWS CloudHSM

Answer 2

• Allows users to generate and use their own encryption keys on AWS cloud
• Dedicated HSM instances for key generation, storage and management
• FIPS compliant (high security standard)

Question 3

IAM Execution Role

Answer 3

• role that an AWS service assumes to perform actions on your behalf
• role is used to grant permissions to AWS services so they can interact with other AWS resources securely and efficiently

Question 4

Transparent Data Encryption

Answer 4

automatically encrypts data before it is written to storage, and automatically decrypts data when the data is read from storage

Question 5

AWS Secrets Manager

Answer 5

• store secrets, encrypted at rest
• automatic rotation of secrets according to a schedule that you define

Question 6

AWS Certificate Manager

Answer 6

• use to provision, manage, and deploy server certificates
• NOTE: not supported in all regions

Question 7

IAM Certificate store

Answer 7

• only use when ACM is not supported in the region
• cannot upload ACM certificate to IAM
• encrypted cert stored in IAM SSL certificate storage, can support deploying server certs in all regions

Question 8

API Gateway Lambda Authorizer

Answer 8

• API Gateway feature that uses a Lambda function to control access to your API
• When a client makes a request to one of your API’s methods, API Gateway calls your Lambda authorizer, which takes the caller’s identity as input and returns an IAM policy as output

Question 9

Token based Lambda authorizer

Answer 9

A token-based Lambda authorizer (also called a TOKEN authorizer) receives the caller’s identity in a bearer token, such as a JSON Web Token (JWT) or an OAuth token.

Question 10

Request parameter-based Lambda authorizer

Answer 10

A request parameter-based Lambda authorizer (also called a REQUEST authorizer) receives the caller’s identity in a combination of headers, query string parameters, stageVariables, and $context variables.

Question 11

AWS Security Token Service (STS)

Answer 11

• AWS facility for requesting temporary user credentials with limited privileges
• It allows you to acquire short-term access to privileged roles in a controlled manner

Question 12

What header is used for Amazon S3-Managed Encryption keys (SSE-S3)?

Answer 12

x-amz-server-side-encryption

Question 13

What headers are used for SSE-C?

Answer 13

x-amz-server-side​-encryption​-customer-algorithm

x-amz-server-side​-encryption​-customer-key

x-amz-server-side​-encryption​-customer-key-MD5