Identity, secrets, supply chain and adversarial risk.
4 items at advanced level · all topics
A company uses AWS Organizations with all features enabled. For compliance reasons, workloads may only run in two approved AWS Regions. Account administrators in member accounts currently hold the AdministratorAccess policy. The company must prevent resources from being created in any other Region. What should a solutions architect do?
A service control policy is the only control that an account administrator cannot remove, because it caps what identities in a member account may do no matter what their IAM policies say. IAM policies and permissions boundaries can both be edited by the very administrators you are trying to constrain.
An application Pod needs to call the Kubernetes API using a ServiceAccount named deployer. How does the Pod get a token in a current cluster?
Setting serviceAccountName on the Pod is enough. The kubelet requests a short-lived, automatically rotated token through the TokenRequest API and mounts it as a projected volume.
A NetworkPolicy ingress rule has one from entry containing both a namespaceSelector (user=alice) and a podSelector (role=client). Which traffic is allowed?
Selectors inside one from entry are combined with AND. Splitting them into two entries in the from list makes it OR, and that single dash is the whole difference.
A shared Gateway lives in the infra namespace. A team applies an HTTPRoute in their own namespace referencing that Gateway, and it is not accepted. What is required?
A Gateway only accepts routes from its own namespace by default. Attaching a route from elsewhere requires the Gateway's listener to permit it through allowedRoutes.