Configuring credentials in AWS - Practice Exercises

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding AWS Credentials Storage

Where does the AWS CLI store credentials by default after running aws configure?

A In environment variables only

B In the AWS S3 bucket named 'aws-credentials'

C In the AWS Management Console under IAM Users

D In the <code>~/.aws/credentials</code> file on the local machine

💡 Hint

Think about where the AWS CLI saves your access keys locally.

The AWS CLI stores credentials in the ~/.aws/credentials file by default. This file contains your access key ID and secret access key for different profiles.

❓ security

intermediate

Identifying Risks of Hardcoding Credentials

What is the main security risk of hardcoding AWS credentials directly in application code?

A Credentials can be accidentally exposed if the code is shared or pushed to public repositories

B The application will run slower due to embedded credentials

C AWS automatically revokes hardcoded credentials after 24 hours

D Hardcoded credentials increase the cost of AWS services

💡 Hint

Think about what happens if someone else sees your code with credentials inside.

Hardcoding credentials risks accidental exposure, especially if the code is shared publicly or with unauthorized users. This can lead to unauthorized access to your AWS resources.

❓ Configuration

advanced

Using Environment Variables for AWS Credentials

Which environment variables must be set to provide AWS credentials for an application without using the AWS CLI configuration files?

A AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

B AWS_PROFILE and AWS_REGION

C AWS_SESSION_TOKEN and AWS_DEFAULT_OUTPUT

D AWS_BUCKET_NAME and AWS_ACCESS_KEY

💡 Hint

Focus on the variables that hold the key ID and secret key.

The environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY provide the access key and secret key directly to applications, bypassing config files.

❓ service_behavior

advanced

Effect of Missing Credentials on AWS SDK Calls

What happens when an AWS SDK call is made without any configured credentials available?

A The SDK automatically creates temporary credentials

B The SDK call succeeds with limited read-only access

C The SDK call fails with an authentication error indicating missing credentials

D The SDK retries indefinitely until credentials are provided

💡 Hint

Think about how AWS protects resources from unauthorized access.

If no credentials are found, AWS SDK calls fail with an authentication error because AWS cannot verify the caller's identity.

❓ Architecture

expert

Best Practice for Managing Credentials in a Multi-Account AWS Environment

In a multi-account AWS setup, what is the best practice to manage credentials securely and efficiently for applications that need access across accounts?

A Use the root account credentials for all applications to simplify access

B Use AWS IAM roles with cross-account trust and assume-role functionality instead of sharing static credentials

C Store all credentials in a shared S3 bucket accessible by all applications

D Create separate IAM users in each account and hardcode their credentials in applications

💡 Hint

Consider how AWS recommends granting temporary access securely between accounts.

Using IAM roles with cross-account trust allows applications to assume roles securely without sharing long-term credentials, following AWS best practices for security and scalability.

Practice

1. What is the main purpose of AWS credentials?

easy

A. To prove your identity and allow access to AWS services

B. To store your AWS billing information

C. To configure your AWS service regions

D. To monitor AWS service usage

Solution

1. Step 1: Understand what credentials do

   AWS credentials are like a key that proves who you are when you use AWS services.

2. Step 2: Identify the correct purpose

   They allow AWS to know you and give you permission to use services securely.

3. Final Answer:

   To prove your identity and allow access to AWS services -> Option A

4. Quick Check:

   Credentials = Identity proof [OK]

Hint: Credentials prove identity to AWS services [OK]

Common Mistakes:

• Confusing credentials with billing info
• Thinking credentials set regions
• Assuming credentials monitor usage

2. Which file stores AWS access keys for different profiles by default?

easy

A. ~/.aws/config

B. ~/.aws/credentials

C. /etc/aws/keys

D. ~/.aws/access

Solution

1. Step 1: Recall default AWS credential file

   AWS stores access keys in the file named 'credentials' inside the '.aws' folder in your home directory.

2. Step 2: Differentiate from config file

   The 'config' file stores settings like region and output format, not keys.

3. Final Answer:

   ~/.aws/credentials -> Option B

4. Quick Check:

   Access keys = ~/.aws/credentials [OK]

Hint: Access keys live in ~/.aws/credentials file [OK]

Common Mistakes:

• Mixing up config and credentials files
• Using wrong file paths
• Assuming keys are in system folders

3. Given this AWS credentials file snippet:

[default]
aws_access_key_id=AKIA123456
aws_secret_access_key=secret123

[dev]
aws_access_key_id=AKIADEV123
aws_secret_access_key=devsecret456

What happens if you run AWS CLI without specifying a profile?

medium

A. It asks you to enter credentials manually

B. It uses the 'dev' profile credentials

C. It throws an error for missing profile

D. It uses the 'default' profile credentials

Solution

1. Step 1: Identify default profile usage

   When no profile is specified, AWS CLI uses the 'default' profile credentials automatically.

2. Step 2: Check the given profiles

   The file has a 'default' and a 'dev' profile; without specifying, 'default' is chosen.

3. Final Answer:

   It uses the 'default' profile credentials -> Option D

4. Quick Check:

   No profile specified = default used [OK]

Hint: No profile given? AWS CLI uses 'default' [OK]

Common Mistakes:

• Assuming 'dev' is default
• Expecting error without profile
• Thinking manual input is required

4. You try to run AWS CLI commands but get an error: Unable to locate credentials. What is the most likely cause?

medium

A. The AWS region is not set in config

B. The AWS CLI version is outdated

C. The ~/.aws/credentials file is missing or empty

D. Your internet connection is down

Solution

1. Step 1: Understand the error meaning

   'Unable to locate credentials' means AWS CLI cannot find your access keys anywhere.

2. Step 2: Identify common causes

   This usually happens if the credentials file is missing, empty, or incorrectly placed.

3. Final Answer:

   The ~/.aws/credentials file is missing or empty -> Option C

4. Quick Check:

   Missing credentials file = error [OK]

Hint: Check if ~/.aws/credentials file exists and has keys [OK]

Common Mistakes:

• Blaming CLI version for missing credentials
• Confusing region setting with credentials
• Assuming internet issues cause credential errors

5. You want to securely allow an EC2 instance to access S3 without storing access keys on the instance. Which method should you use?

hard

A. Use IAM roles attached to the EC2 instance

B. Hardcode access keys in your application code

C. Store access keys in ~/.aws/credentials on the instance

D. Use environment variables with access keys on the instance

Solution

1. Step 1: Identify secure credential methods

   Storing keys on the instance or in code risks exposure and is not best practice.

2. Step 2: Use IAM roles for EC2

   IAM roles provide temporary credentials automatically and securely to the instance without manual keys.

3. Final Answer:

   Use IAM roles attached to the EC2 instance -> Option A

4. Quick Check:

   EC2 access without keys = IAM roles [OK]

Hint: Use IAM roles for EC2 to avoid storing keys [OK]

Common Mistakes:

• Storing keys on instance files
• Hardcoding keys in code
• Using environment variables insecurely