> For the complete documentation index, see [llms.txt](https://anon-coders-notes.gitbook.io/techwriterdev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://anon-coders-notes.gitbook.io/techwriterdev/cloud/aws/developerassociate/services/12_sdk_cli_tips/00_basics.md).

# Access AWS Resources

## Instance Metadata Service (IMDS)

* Allows EC2 instances to learn about themselves without using an IAM role for that purpose.
* URL is `http://169.254.169.254/latest/metadata`.
* Using this feature one can extract many details other than IAM policy itself like,
  * IP address
  * IAM role name
  * Launch script
* There are two versions
  * IMDS v1
    * Uses URL `http://169.254.169.254/latest/metadata` to retrieve the metadata directly.
  * IMDS v2
    * A more secure version of IMDS V1.
    * Uses token to retrieve the metadata information.

      ```sh
          $TOKEN = `curl -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"`
      ```
    * Use the token retrieved from above request to make the metadata request.

      ```sh
          curl http://169.254.169.254/latest/metadata/ -H "X-aws-ec2-metadata-token: $TOKEN"
      ```
    * Only this version is supported for Amazon Linux 2023.

## AWS CLI

### [Introduction](/techwriterdev/cloud/aws/cloudpractitioner/07_accessing_aws_resources.md#aws-command-line-interface-cli)

### Profiles

* When there are multiple accounts that need to be connected to using AWS CLI, we can use profiles to isolate the accounts and use their respective credentrials to connect to AWS.
* To create a profile use the command below,

  ```sh
      aws configure --profile <profile_name>
  ```
* To query the AWS resources using CLI and profiles use the below command.

  ```sh
      aws [command] [option] --profile <profile_name>
      # Example
      aws s3 ls --profile dev
  ```

### MFA

* To use MFA and CLI tool, use the `STS (Security Token Service) GetSessionToken` API to get a temporary session, see below for example.

  ```sh
      aws sts get-session-token --serial-number <arn-of-mfa-device> --token-code <token-code-from-mfa> --duration-seconds <seconds>
  ```

  * You get the arn of mfa device when register one in your account.
  * Output of above command looks like below,

  ```json
      {
          "Credentials": {
              "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
              "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY",
              "SessionToken": "AQoEXAMPLEH4aoAH0gNCAPyJxz4BlCFFxWNE1OPTgk5TthT+FvwqnKwRcOIfrRh3c/LTo6UDdyJwOOvEVPvLXCrrrUtdnniCEXAMPLE/IvU1dYUg2RVAJBanLiHb4IgRmpRV3zrkuWJOgQs8IZZaIv2BXIa2R4OlgkBN9bkUDNCJiBeb/AXlzBBko7b15fjrBs2+cTQtpZ3CYWFXG8C5zqx37wnOE49mRl/+OtkIKGO7fAE",
              "Expiration": "2020-05-19T18:06:10+00:00"
          }
      }   
  ```

  * Ensure the token obtained from the above command is added to `~/.aws/credentials` file against the key `aws_session_token`.

> Note for all the above commands to work **user account** should have relevant access granted.

### Credentials Chain Provider

#### CLI

* The CLI looks for credentials in the following order, *(precedence order is high to low)*
  1. CLI options
  2. Environment Variables *(AWS\_ACCESS\_KEY\_ID, AWS\_SECRET\_ACCESS\_KEY, AWS\_SESSION\_TOKEN)*.
  3. Default CLI credentials file *(typically located at \~/.aws/credentials)*.
  4. CLI configuration file *(typically located at \~/.aws/config)*.
  5. Container credentials for ECS task.
  6. Instance profile credentails for EC2 Instance Profile.

#### SDK

**Icon**

![SDK Icon](https://icon.icepanel.io/AWS/svg/Developer-Tools/Tools-and-SDKs.svg)

**About**

* The SDK *(say java)* looks for credentials in the following order, *(precedence order is high to low)*
  1. System properties *(aws.accessKeyId and aws.secretKey)*.
  2. Environment Variables *(AWS\_ACCESS\_KEY\_ID, AWS\_SECRET\_ACCESS\_KEY)*
  3. Default credentials profile file *(typically located at \~/.aws/credentials)*
  4. AWS configuration file *(typically located at \~/.aws/config)*
  5. Container credentials for ECS containers
  6. Instance profile credentails for EC2 Instance
* For CLI
  * Same as SDK but first precedence will be cli option.
  * Then on same as SDK from point 2.
* If no region is given, by default `us-east-1` will be selected.

#### Best Practices

* Never store credentials in code. Let them be inherited from the credentials chain.
* Use IAM roles as per the requirement.
* Use Named profiles or environment variables when working outside of AWS.

## API Limits

### Rate Limits

* `DescribeInstances` API for EC2 has a limit 0f 100 request/second.
* `GetObject` on S3 has a limit of 5500 GET request/second per prefix.
* Can ask AWS to increase the limit as per the need.

### Service Limits

* Running On-Demand Standard instances: 1152 vCPU.
* Can increase the limits as per need by asking AWS through a service ticket.

#### Service Quota Limits

* These limits are enforced by AWS and can be increased by making a service quota API request programmatically.

### Throttling Exception

* This exception is raised when too many API calls are made and AWS intermittently raises this exception.
* This exception is a sign to use exponential backoff while making request.
* SDKs handle this behaviour inherently.
* Using APIs directly would require explicit exponential backoff implementation.
  * For `5xx` server errors should only be retried.
  * Dont implement retries for `4xx` client errors.

## Signing AWS Request API

* Uses AWS signature : *(Sig v4)*
* There are 3 ways of doing it
  * Authorization headers
    * `Authorization`
    * `Signature`
    * `SignedHeaders`
  * Query parameters
    * `X-Amz-Algorithm`
    * `X-Amz-Credential`
    * `X-Amz-Date`
    * `X-Amz-Signature`
  * Browser based uploads USING POST

## Reference

* [AWS CLI](https://docs.aws.amazon.com/cli/latest/reference/)
* [AWS STS](https://docs.aws.amazon.com/cli/latest/reference/sts/)
* [IMDS Categories](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html)
* [Sig V4 Request Signing](https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html)
* [Sig V4 Headers](https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html)
* [Credentials Precedence](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#config-settings-and-precedence)