Using profiles for multiple accounts in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to list S3 buckets using a specific AWS profile.

AWS

aws s3 ls --profile [1]

Drag options to blanks, or click blank then click option'

Adefault

Bprod-account

Cdev-account

Dtest-account

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' when you want a specific account

Omitting the --profile option

Using a profile name that does not exist

The --profile option specifies which AWS profile to use for the command. Here, dev-account is the profile name.

2fill in blank

medium

Complete the AWS CLI command to configure a new profile named 'prod-account'.

AWS

aws configure --profile [1]

Drag options to blanks, or click blank then click option'

Adev-account

Bprod-account

Cdefault

Dtest-account

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' instead of the intended profile name

Misspelling the profile name

Omitting the --profile option

The --profile option followed by prod-account creates or updates that profile's configuration.

3fill in blank

hard

Fix the error in the command to assume a role using a profile.

AWS

aws sts assume-role --role-arn [1] --role-session-name MySession --profile dev-account

Drag options to blanks, or click blank then click option'

Aarn:aws:iam::123456789012:role/DevRole

Barn:aws:s3:::mybucket

Carn:aws:iam::123456789012:user/DevUser

Darn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0

Attempts:

3 left

💡 Hint

Common Mistakes

Using a user ARN instead of a role ARN

Using a resource ARN like S3 bucket or EC2 instance

Misspelling the ARN

The --role-arn must specify an IAM role ARN, not a bucket, user, or EC2 instance ARN.

4fill in blank

hard

Fill both blanks to set environment variables for AWS CLI to use the 'test-account' profile.

AWS

export AWS_PROFILE=[1]
aws s3 ls --profile [2]

Drag options to blanks, or click blank then click option'

Atest-account

Bprod-account

Cdev-account

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using different profiles in environment variable and command

Using 'default' instead of the intended profile

Omitting the export command

Setting AWS_PROFILE environment variable and using the same profile in the command ensures consistent profile usage.

5fill in blank

hard

Fill all three blanks to create a named profile with access key and region.

AWS

[[1]]
aws_access_key_id=[2]
region=[3]

Drag options to blanks, or click blank then click option'

Aprod-account

BAKIAIOSFODNN7EXAMPLE

Cus-west-2

Ddev-account

Attempts:

3 left

💡 Hint

Common Mistakes

Using profile name without brackets

Swapping access key and region values

Using incorrect region format

The profile name goes in brackets, followed by the access key and region settings.

Practice

1. What is the main purpose of using AWS profiles when working with multiple accounts?

easy

A. To store different account credentials separately on the same computer

B. To speed up AWS CLI commands by caching results

C. To automatically switch regions without user input

D. To encrypt data stored in AWS S3 buckets

Solution

1. Step 1: Understand AWS profiles

   AWS profiles allow you to save different sets of credentials and settings for multiple accounts on one computer.

2. Step 2: Identify the purpose

   This separation helps you choose which account to use without mixing credentials.

3. Final Answer:

   To store different account credentials separately on the same computer -> Option A

4. Quick Check:

   Profiles separate credentials = B [OK]

Hint: Profiles separate accounts by credentials [OK]

Common Mistakes:

• Thinking profiles speed up commands
• Confusing profiles with region switching
• Assuming profiles encrypt data

2. Which AWS CLI command syntax correctly uses a profile named dev-account to list S3 buckets?

easy

A. aws s3 ls dev-account --profile

B. aws --profile s3 ls dev-account

C. aws --profile dev-account s3 ls

D. aws s3 ls dev-account

Solution

1. Step 1: Recall AWS CLI profile usage

   The correct syntax places --profile dev-account as a global option right after aws, before the service s3 ls.

2. Step 2: Match syntax to options

   aws --profile dev-account s3 ls correctly uses the profile flag.

3. Final Answer:

   aws --profile dev-account s3 ls -> Option C

4. Quick Check:

   Correct flag placement = A [OK]

Hint: --profile after aws, before service [OK]

Common Mistakes:

• Placing --profile after profile name
• Swapping command and profile flag order
• Omitting --profile flag

3. Given these AWS CLI commands run on the same machine:

aws --profile prod s3 ls
aws --profile dev s3 ls

What will happen if the prod profile has access to 5 buckets and dev profile has access to 2 buckets?

medium

A. Both commands fail due to profile conflict

B. The first command lists 5 buckets; the second lists 2 buckets

C. Both commands list 5 buckets only

D. Both commands list 7 buckets combined

Solution

1. Step 1: Understand profile isolation

   Each profile uses its own credentials and permissions, so commands run under different profiles see different resources.

2. Step 2: Apply to bucket listing

   The prod profile lists 5 buckets it can access; the dev profile lists 2 buckets it can access.

3. Final Answer:

   The first command lists 5 buckets; the second lists 2 buckets -> Option B

4. Quick Check:

   Profiles isolate access = D [OK]

Hint: Profiles show only their own account's buckets [OK]

Common Mistakes:

• Assuming buckets combine across profiles
• Expecting profile conflicts cause failure
• Thinking both profiles show same buckets

4. You run the command aws --profile test ec2 describe-instances but get an error: Could not find credentials for profile: test. What is the most likely cause?

medium

A. The EC2 service is down in your region

B. The AWS CLI version is outdated

C. You forgot to specify the region with --region

D. The profile test is not configured in your AWS credentials file

Solution

1. Step 1: Analyze error message

   The error says credentials for profile test are missing, meaning AWS CLI cannot find that profile in config files.

2. Step 2: Identify cause

   This usually happens if the profile was never added or misspelled in ~/.aws/credentials or ~/.aws/config.

3. Final Answer:

   The profile test is not configured in your AWS credentials file -> Option D

4. Quick Check:

   Missing profile config = A [OK]

Hint: Check profile exists in credentials file [OK]

Common Mistakes:

• Blaming AWS CLI version
• Assuming region missing causes credential error
• Thinking service outage causes credential error

5. You want to run an AWS CLI command that uses the prod profile but also specify the region us-west-2 without changing your default region. Which command correctly does this?

hard

A. aws --profile prod --region us-west-2 s3 ls

B. aws s3 ls --region us-west-2 --profile prod

C. aws s3 ls --profile prod region us-west-2

D. aws s3 ls prod --region us-west-2

Solution

1. Step 1: Understand flag order and usage

   Global options like --profile and --region must be placed after aws but before the service name. Their relative order does not matter.

2. Step 2: Check options for correctness

   Only aws --profile prod --region us-west-2 s3 ls correctly places both flags before the service.

3. Final Answer:

   aws --profile prod --region us-west-2 s3 ls -> Option A

4. Quick Check:

   Global flags before service = C [OK]

Hint: Global flags (--profile, --region) after aws before service [OK]

Common Mistakes:

• Omitting --profile or --region flags
• Placing profile name without --profile flag
• Using incorrect flag syntax