AWS CLI, SDK, IAM Roles & Policies

AWS CLI, SDK & Request Signing

Summary: Covers how you actually talk to AWS from the command line or from application code - CLI profiles, the SDK, EC2 instance metadata, service limits/throttling, and how every request gets signed under the hood.

Key Concepts

EC2 Instance Metadata (IMDS)

• Lets an EC2 instance “learn about itself” from inside itself, without needing an IAM Role for that purpose
• Query it at http://169.254.169.254/latest/meta-data - returns instance ID, IAM role name, security groups, network config, etc.
• You can retrieve the IAM Role name from metadata, but not the IAM Policy itself
• Metadata = info about the instance; userdata = the launch script

What IMDS is actually for

It’s how a script or app running on the instance self-configures at boot - reading its own instance ID, role, or network info - without hardcoding any of it or needing credentials to ask.

IMDSv1 vs IMDSv2

• v1: direct GET to the metadata endpoint
• v2: more secure, two steps - (1) get a session token via a PUT request, (2) use that token in subsequent metadata calls

AWS CLI Profiles

Named, independently-authenticated credential/config bundles - each with its own access key, secret key, and default region. Not just an alias for one account: a profile can point to a different AWS account entirely, or a different IAM user/role within the same account.

aws configure --profile my-other-aws-account
# prompts for Access Key ID, Secret Access Key, default region
 
cat credentials # now shows two profiles
 
aws s3 ls --profile my-other-aws-account
 
cat config # shows your default profile + all others

MFA with the CLI

• To use MFA-protected access via the CLI, create a temporary session with the STS GetSessionToken API call

aws sts get-session-token --serial-number arn-of-the-mfa-device --token-code code-from-token --duration-seconds 3600

AWS SDK

• Lets you perform actions on AWS directly from application code - use it whenever you’re coding against AWS services rather than working from a terminal

Configuration & Limits

API Rate Limits vs Service Quotas

• API Rate Limits: how many times you can call an API
  • Intermittent throttling errors -> implement exponential backoff
  • Consistent throttling errors -> request an API rate limit increase
• Service Quotas (Service Limits): how many resources you can run of something
  • Request a limit increase via a support ticket, or via the Service Quotas API

Exponential Backoff

• Use when you get ThrottlingException intermittently
• Already built into AWS SDK API calls
• Must implement it yourself if calling the raw AWS API directly (or in specific edge cases)

Signing AWS API Requests

• Every AWS HTTP API call is signed with your access key + secret key so AWS can identify you
• The SDK and CLI sign requests for you automatically
• Some S3 requests don’t need to be signed
• Signing method: Signature v4 (SigV4)

Two SigV4 signing options - different use cases, not competing:

• HTTP header option - signature goes in the Authorization header; this is what the SDK/CLI use for normal signed API calls

  

• Query string option - signature goes in X-Amz-Signature; used when you can’t attach custom headers, e.g. S3 pre-signed URLs shared as a plain link, with an expiry baked into the URL

  

Exam Tips & Gotchas

Don't confuse the two SigV4 signing methods

Header-based signing is for normal SDK/CLI API calls. Query-string signing is specifically for cases like pre-signed URLs, where the signature has to live in the URL itself (e.g. shared links, browser downloads) rather than a header.

• IMDSv2 over IMDSv1: the token requirement blocks SSRF attacks that could otherwise trick an app into leaking instance role credentials via the metadata endpoint - a frequent exam trap.
• Metadata gives you the IAM Role name, never the policy document itself - don’t confuse “what role” with “what permissions.”
• Rate limit vs. service quota: intermittent throttling → exponential backoff; consistent throttling → request an API rate limit increase. Quotas (how many resources you can run) are raised via a support ticket or the Service Quotas API - a different lever entirely.

Integrations

• IAM - IAM Roles and policies are what CLI profiles and the SDK ultimately authenticate against; see IAM.md for roles, policies, and MFA device setup
• EC2 - IMDS runs on every EC2 instance
• STS - issues the temporary session used for MFA-protected CLI calls (GetSessionToken)

Review Questions

What can you retrieve from EC2 instance metadata, and what can't you retrieve?

A: You can retrieve the IAM Role name attached to the instance; you cannot retrieve the IAM Policy itself.

What's the difference between IMDSv1 and IMDSv2?

A: IMDSv1 is a direct GET to the metadata endpoint. IMDSv2 is more secure and requires two steps: get a session token via PUT, then use that token in subsequent metadata calls.

What's the difference between an API rate limit and a service quota?

A: API rate limits govern how many times you can call an API (fix intermittent breaches with exponential backoff, request an increase for consistent ones). Service quotas govern how many resources you can run of something (increase via support ticket or the Service Quotas API).

How do you use MFA with the AWS CLI?

A: Create a temporary session via the STS GetSessionToken API call, passing the MFA device ARN and the current token code.

What are the two ways to pass a SigV4 signature, and when is each used?

A: HTTP header (Authorization header) for normal SDK/CLI API calls, or query string (X-Amz-Signature) for cases like S3 pre-signed URLs where the signature must live in the URL itself.