Temporary credentials quiz · Level 0

Question 1An engineer signs in to the IAM Identity Center access portal and opens the Prod account. What credentials do they get in Prod?

Temporary credentials for a role that Identity Center created from their permission set.Correct. Signing in means assuming a role, so the credentials expire on their own. No long-lived keys exist to leak.The password of an IAM user in Prod.Not this one. Identity Center doesn't create IAM users in the accounts.Permanent access keys for Prod.Not this one. Nothing here is permanent. That's the point.The Prod root user's credentials.Not this one. Root is never handed out by Identity Center.

Learn it: IAM Identity Center · Temporary credentials

Question 2The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?

Attach an IAM role to the instance through an instance profile.Correct. The SDK fetches temporary credentials for the role from the instance itself, and they rotate automatically. There are no long-lived keys to leak.Create an IAM user's access keys and put them in the app's config file.Not this one. Long-lived keys in a file get copied, committed to Git and forgotten. Anyone who finds them has the access.Pass access keys to the instance in its user data.Not this one. User data is readable by anything on the instance and isn't secret. It's no safer than a config file.Use the root user's access keys, because they never expire.Not this one. Never expiring is the problem. Root keys should not exist at all.

Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2

Question 3Todo.io's app on EC2 has a role attached through an instance profile. Where does the AWS SDK get the role's credentials from?

From the instance metadata service at 169.254.169.254, on the instance's host.Correct. The SDK asks for temporary credentials and refreshes them before they expire. Nothing is stored in a file.From a file the team uploads to the instance.Not this one. That would be long-lived keys on disk, which roles exist to avoid.From an S3 bucket.Not this one. Credentials are never fetched from a bucket.From the IAM Identity Center access portal.Not this one. The portal is for people. Software on EC2 uses its instance profile.

Learn it: Temporary credentials · IAM role

Question 4What does "Temporary credentials" mean?

Short-lived AWS keys handed out for a role, which expire automatically.Correct. Think of it as: A wristband that's only valid for today.The unique full name of an AWS resource.Not this one. That describes ARN (Amazon Resource Name).A role an AWS service creates and owns so it can act in your account on its own behalf.Not this one. That describes Service-linked role.A JSON document listing allowed (or denied) actions on resources.Not this one. That describes IAM policy.

Learn it: Temporary credentials

Question 5Which term is this? "Short-lived AWS keys handed out for a role, which expire automatically."

Temporary credentialsCorrect. Yes. Think of it as: A wristband that's only valid for today.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources.

Learn it: Temporary credentials

Question 6Which AWS term is described by this analogy? "A wristband that's only valid for today."

Temporary credentialsCorrect. Yes: Short-lived AWS keys handed out for a role, which expire automatically.ARN (Amazon Resource Name)Not this one. ARN (Amazon Resource Name) is: The unique full name of an AWS resource. Its analogy: A full postal address, down to the flat number.Service-linked roleNot this one. Service-linked role is: A role an AWS service creates and owns so it can act in your account on its own behalf. Its analogy: A contractor's own access badge, issued and controlled by the contractor's company.IAM policyNot this one. IAM policy is: A JSON document listing allowed (or denied) actions on resources. Its analogy: The list of rooms printed on the back of a badge.

Learn it: Temporary credentials

Temporary credentials

Worth another look

Your weak spots

Services

Concepts