Using profiles for multiple accounts in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding AWS CLI Profiles

You have configured two AWS CLI profiles named dev and prod for different AWS accounts. Which command correctly lists the S3 buckets in the prod account?

A aws s3 ls --profile dev

B aws s3 ls --account prod

C aws s3 ls --profile prod

D aws s3 ls

💡 Hint

Use the --profile option to specify which account profile to use.

The AWS CLI uses the --profile flag to select the credentials and settings from the named profile. Using --profile prod runs the command with the prod account credentials.

❓ Configuration

intermediate

Configuring Multiple AWS Profiles

You want to add a new AWS CLI profile named test with access key AKIA123TEST and secret key secretTestKey. Which command correctly sets this profile?

A aws configure set profile test aws_access_key_id AKIA123TEST aws_secret_access_key secretTestKey

B aws configure set aws_access_key_id AKIA123TEST --profile test && aws configure set aws_secret_access_key secretTestKey --profile test

C aws configure create test AKIA123TEST secretTestKey

D aws configure add-profile test --access-key AKIA123TEST --secret-key secretTestKey

💡 Hint

Use aws configure set with the --profile option to set keys for a named profile.

The aws configure set command sets individual configuration values. Using --profile test applies the settings to the test profile. Options A, B, and C are invalid AWS CLI commands.

❓ Architecture

advanced

Best Practice for Managing Multiple AWS Accounts

You manage multiple AWS accounts for development, testing, and production. Which approach best isolates credentials and reduces risk?

A Use separate AWS CLI profiles for each account with unique credentials stored locally.

B Use the same AWS CLI profile with shared credentials for all accounts.

C Use environment variables to switch credentials manually without profiles.

D Use a single root account access key for all environments.

💡 Hint

Consider isolation and security best practices when managing multiple accounts.

Using separate profiles with unique credentials isolates access and reduces risk if one set is compromised. Sharing credentials or using root keys increases security risks.

❓ service_behavior

advanced

Effect of Profile on AWS SDK Behavior

You run a Python script using boto3 without specifying a profile. Your AWS CLI has two profiles: default and staging. Which profile will boto3 use by default?

AWS

import boto3
s3 = boto3.client('s3')
buckets = s3.list_buckets()
print([b['Name'] for b in buckets['Buckets']])

A The <strong>default</strong> profile configured in AWS CLI.

B No profile; the script will fail with a credentials error.

C The <strong>staging</strong> profile because it is the last created.

D The profile specified in the AWS_PROFILE environment variable, if set; otherwise <strong>default</strong>.

💡 Hint

Check how boto3 selects credentials when no profile is explicitly given.

boto3 uses the AWS SDK credential provider chain. It first checks the AWS_PROFILE environment variable. If not set, it uses the default profile. If no credentials are found, it raises an error.

❓ security

expert

Security Risk of Storing AWS Credentials in Plain Text

You have multiple AWS CLI profiles stored in ~/.aws/credentials file in plain text. What is the main security risk of this setup?

A If the file permissions are too open, unauthorized users or processes can read the credentials and access your AWS accounts.

B AWS automatically encrypts the credentials file, so there is no risk.

C Storing credentials in plain text causes AWS to reject API calls for security reasons.

D The credentials file can only be accessed by root user, so there is no risk.

💡 Hint

Consider file permissions and who can read the credentials file.

The credentials file is stored in plain text. If file permissions are not restrictive, other users or malware on the system can read the keys and misuse them. AWS does not encrypt this file automatically.