CLI & SDK

Question 1

Using the CLI, how can you test whether or not you have the correct permissions to complete a task.

Answer 1

• Use the CLI –dry run command BEFORE the commands you are testing.
• If it is successful, a message will be returned that the task was not complete because of the –dry-run flag but that you do have correct permissions.
• Otherwise an error message is returned with an STS encrypted message.

Question 2

How can you decrypt an STS (security service token) message in the CLI?

Answer 2

You run the sts decode-authorization-message command.

Question 3

How can you use MFA with CLI?

Answer 3

• You must create a temporary session
• In order to create a temporary session you must run the security service token (STS ) GetSessionToken API call

Question 4

What programming language is the CLI written in?

Answer 4

Python SDK (boto3)

Question 5

When should you use an AWS SDK?

Answer 5

*** THIS IS A PLACEHOLDER -

EXAM EXPECTS YOU TO KNOW THIS - MORE LATER ***

Question 6

What should you do if you get a ThrottlingException intermittenly?

Answer 6

• Use Exponential Backoff
• It is a retry mechanism included in SDK API calls
• This must be implemented yourself is using the API as is or in specific cases

Question 7

AWS CLI Credentials Provider Chain

In what order (first to last) does the CLI look for credentials?

Answer 7

1. Command Line Options
2. Environment Variables
3. CLI credentails file
4. CLI configuration file
5. Container credentials
6. Instance profile credentials

Question 8

AWS SDK Default Credentials Provider Chain

In what order does an SDK look for credentials?

Answer 8

1. Environment variables
2. system properties
3. default credential profiles file
4. Amazon ECS container credentials
5. Instance profile credentials

Question 9

What is Signature v4 (SigV4)?

Answer 9

Means that your requests to AWS are signed using your credentials so that you are authenticated against AWS

EXAMPLES

• Sign request usin HTTP Headers
• Query String Option (i.e. S3 presigned URL)

Question 10

I have an on-premise personal server that I’d like to use to perform AWS API calls. How should I do this?

Answer 10

I should run aws configure and put my credentials there. Invalidate them when I’m done.