Identity, secrets, supply chain and adversarial risk.
14 items at intermediate level · all topics
Explain how AWS IAM Role assumption works across different AWS accounts securely.
One account can use another account's resources without a password or an access key ever changing hands. The role's trust policy decides who is allowed in, its permissions policy decides what they can do once they're there, and STS hands out credentials that expire on their own.
A subnet holds your most sensitive data. Design the Network ACL rules around it as a second layer of defense behind Security Groups.
A NACL earns its place by doing the one thing a Security Group can't: an explicit, subnet-wide deny that survives a misconfigured Security Group rule. The design is a default-deny rule set with narrow, numbered exceptions, remembering that NACLs are stateless, so return traffic on ephemeral ports needs its own explicit allow.
Multiple teams share one AWS account. How do you structure IAM so each team can only touch the resources they own?
Individual users each get their own IAM role via SSO federation, never a shared login or a long-lived access key, and permissions are grouped by team into roles scoped with resource tags rather than hardcoded ARNs. Past a certain team count, the real fix is separate AWS accounts per team, not tighter policies inside one shared account.
How do you make sure data is encrypted everywhere it lives in AWS, both at rest and in transit, without it becoming a project unto itself?
At rest, nearly every AWS storage service takes a KMS key as a one-time setting at creation, and the actual work is deciding who can use that key, not the encryption itself. In transit, TLS terminated with a Certificate Manager certificate covers the external hop, but internal service-to- service traffic needs its own explicit decision, since nothing enforces it by default.
Design layered protection for a public-facing web application against DDoS attacks and common web exploits.
No single AWS service handles both problems, since a volumetric DDoS attack and a targeted web exploit look nothing alike at the network layer. CloudFront and Shield absorb and dilute volume before it reaches your origin, and WAF inspects individual requests for exploit patterns. Both sit in front of the origin, stacked, not swapped for each other.
A company hires an external cost-optimisation vendor that needs read access to resources in the company's AWS account. The vendor runs from its own AWS account and serves many other customers. Which solution meets this requirement MOST securely?
Third-party access is an IAM role the vendor assumes from their own account, never an IAM user with access keys. The detail that separates a good answer from a nearly-good one is the external ID condition in the trust policy, which is what stops another of the vendor's customers from tricking them into acting on your account.
A compliance review finds that an existing Amazon EBS volume attached to a production EC2 instance is unencrypted. The data on the volume must be encrypted at rest with an AWS KMS key. Which sequence of steps achieves this?
You cannot turn encryption on for an existing EBS volume in place. The supported path is to snapshot it, copy the snapshot with encryption enabled, create a new volume from the encrypted copy, and swap it onto the instance.
An application on Amazon ECS connects to an Amazon RDS for PostgreSQL database using a username and password stored in the task definition as plaintext environment variables. Security policy now requires that the database password be encrypted at rest and rotated automatically every 30 days. Which solution meets these requirements with the LEAST operational overhead?
Secrets Manager is the service that rotates credentials for you, and it has built-in rotation for RDS. Parameter Store SecureString encrypts a value perfectly well but has no native rotation, so choosing it means writing and owning the rotation yourself.
A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?
These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.
An audit discovers that several Amazon S3 buckets across a company's AWS accounts have been made publicly readable by developers. The company must guarantee that no bucket in any account can be made public, and must be alerted to any bucket policy that grants access outside the organization. Which combination of actions meets these requirements?
S3 Block Public Access enforced at the account level is the preventive control, and IAM Access Analyzer is the detective one. The pairing matters: the exam separates stopping something from noticing it, and this stem asks for both.
A ClusterRole named pod-reader grants get, list and watch on pods. You create a RoleBinding in the dev namespace that binds this ClusterRole to user alice. What can alice do?
A RoleBinding that references a ClusterRole grants those permissions only inside the RoleBinding's own namespace. The same ClusterRole reused this way is how one definition serves many namespaces.
You apply a NetworkPolicy that should block all ingress to a namespace, but every Pod stays reachable. kubectl get networkpolicy shows the object exists. What is the most likely explanation?
NetworkPolicies are enforced by the network plugin. If the cluster's CNI plugin does not implement them, the objects are accepted by the API server and have no effect.
Write the smallest NetworkPolicy that denies all ingress traffic to every Pod in a namespace. Which spec achieves it?
An empty podSelector selects every Pod in the namespace, and policyTypes: Ingress with no ingress rules allows nothing. That combination is the documented default-deny policy.
An application using the ServiceAccount ci in the build namespace gets a 403 listing Pods. Which command confirms the permission gap without deploying anything?
kubectl auth can-i with --as impersonates the identity and answers yes or no against the real authorization layer, so you can test a ServiceAccount's access from your own session.