Security Token Service

Question 1

What does STS stand for?

Answer 1

Security Token Service

Question 2

What does STS do?

Answer 2

Grants users limited and temporary access to AWS resources.

Question 3

From which sources can users take advantage of STS and gain access to AWS resources?

Answer 3

Federation (typically Active Directory)
Federation with Mobile Apps (Facebook, Google, etc)
Cross-account access

Question 4

For Federation logon, which SSO protocol is used?

Answer 4

SAML (Security Assertion Markup Language)

Question 5

For Federation logon, what is accessed based on?

Answer 5

Active Directory credentials

Question 6

For Active Directory users, is an IAM account required?

Answer 6

No

Question 7

For login via federation with mobile apps, which standard is used for login?

Answer 7

OpenID

Question 8

What is Cross-account access?

Answer 8

Allows users from other AWS accounts access into another AWS account’s resources.

Question 9

What is Federation?

Answer 9

Combining, or joining a list of users from one domain, to a list of users in another.

Question 10

What is an identity broker?

Answer 10

A service that allows you to take an identity from point A and join it (federate it) to point B.

Question 11

What is an identity store?

Answer 11

Service like Active Directoyy, Facebook, Google, etc.

Question 12

What are identities?

Answer 12

A user of a service like Facebook, etc.

Question 13

True or false: When using STS, the application bypasses its own authentication mechanism and uses AWS STS?

Answer 13

False: The idenity broker is always called first.

Question 14

What must an idenity broker provide AWS STS in order to grant a user AWS resources?

Answer 14

An IAM policy
A duration (1 - 36 hours)
permissions to be granted

Question 15

What does STS provide back to the identity broker?

Answer 15

1. Permission to create a token
2. access key
3. secret access key
4. Token
5. A token duration

Question 16

At a high level, how basically does STS federation work?

Answer 16

1. Employee logs into an application
2. The application checks with its identity broker
3. The idenity broker checks with LDAP to validate the user
4. Idenity broker requests a security token from STS
5. STS passes the token to the identity broker
6. idenity broker passes to the application
7. Application will attempt to access S3
8. S3 will validate the token is valid against IAM
9. IAM will approve or deny