- LPU MCA Semester 1
- CAP470
- Unit 8
CAP470 · Unit 8: AWS authentication and authorization
Authentication tools in AWS
10 practice questions · in the ETE syllabus
Key points
- Passwords with MFA for people; access keys or tokens for programs
- The secret key is shown only once
- Rotate keys and prefer temporary credentials
- IAM Identity Center for workforce SSO; Cognito for app users
AWS offers several tools to prove identity.
| Tool | Purpose |
|---|---|
| Console password | Lets an IAM user sign in to the web console |
| MFA (virtual app, hardware token, passkey) | Adds a second factor to a password |
| Access keys (ID and secret) | Long-term credentials for the CLI, SDKs and APIs |
| STS temporary credentials | Short-lived keys and a token returned when a role is assumed |
| IAM Identity Center | Single sign-on and federation with a corporate directory |
| Amazon Cognito | Sign-up and sign-in for the users of your own web or mobile applications |
An access key has two parts, an access key ID and a secret access key. The secret is shown only once, so store it securely and, if it is lost, create a new key. Rotate keys regularly to limit the time a leaked key is useful, and avoid long-term keys by using roles and temporary credentials where possible. The AWS CLI and SDKs sign requests with these credentials. After creating an account, enable MFA on the root user and avoid root access keys.
Exam trap: people use passwords and MFA for the console, while programs use access keys or temporary credentials. Never share the root user's credentials.
Try two questions
A root user account has just been created. Which step is among the first recommended security actions?
- Create access keys for the root user for daily work
- Enable MFA on the root user
- Share the root password with the whole team
- Disable all logging for the account
Show the answer
B. MFA makes a stolen root password insufficient.
Why not A: Root keys should be avoided.
Why not C: Root credentials must not be shared.
Why not D: Logging helps detect misuse.
What two parts make up the long-term programmatic credentials of an IAM user?
- A user name and a billing address
- A public key and a policy name
- An access key ID and a secret access key
- A region and an availability zone
Show the answer
C. Applications and the CLI sign requests with the access key pair.
Why not A: A user name and billing address do not form programmatic credentials.
Why not B: A policy name is not a credential.
Why not D: A region and zone are locations.