‫So now let's talk about a theory lecture
‫on the credentials provided chain in AWS.
‫This is something that can come up in one question
‫on the exam, so good for you to know about it.
‫So when you use the CLI,
‫it will look for credentials in the following order.
‫So it will look for command line options.
‫So if you specify a region, output, a profile
‫or you specify the excess key ID, secret access key
‫and session token in the command line option
‫this has a priority over anything.
‫Then the second place it looks in
‫is the environment variables.
‫So if you set one of these environment variables
‫and you haven't set a command line option
‫then this will take precedence.
‫Then it will look into the CLI credentials file
‫when we run AWS configure,
‫then it will look into the CLI configuration file.
‫Same way it is configured.
‫Then it will look into the container credentials.
‫So if you have an ECS task
‫it will look at the container credentials.
‫And we haven't seen what ETS is yet, but very, very soon.
‫And then finally, if we're using EC2 instance profiles,
‫then he will look at the instance profile credentials.
‫So as we can see, the most priority
‫is going to be command line options,
‫then environment variables.
‫And the least priority is going to be
‫around the EC2 profile credentials
‫or the ECS container credentials.
‫So the idea is that there is a priority
‫and this will be important in one scenario question
‫that it will explain to you very, very soon.
‫So if we look at an SDK, for example, the Java SDK
‫then there will be a similar idea.
‫So the first property that will be taken into place
‫will be the Java system properties.
‫Then we will have the very important environment variables,
‫such as access, key ID and secret access key.
‫And they have higher precedence than anything else
‫except the Java system properties.
‫Then we have the default credential profile files
‫the Amazon ECS container credentials
‫and the instance profile file credentials.
‫So what we want to remember here is that
‫the environment variables still have a higher precedence
‫over for example, the EC2 instance profile credentials.
‫So why am I saying this to you?
‫Well, here is the scenario
‫and this is the kind of things you have to remember.
‫So, say you deploy an application on an EC2 instance
‫and you're using environment variables
‫from an IAM user to call the Amazon S3 API.
‫That's very bad practice to do it, but say, you've done it.
‫So these IAM user you've been using the permissions of
‫has S3 FullAccess permissions.
‫That means that it can do anything it wants
‫on every single buckets in Amazon S3.
‫So the application though deployed
‫only uses one Amazon S3 bucket.
‫So according to best practices
‫because you've been watching this course
‫you are defining an IAM role and an EC2 instance profile
‫that you are creating and assigning on to the EC2 instance.
‫And this role was assigned the minimum permissions
‫to access only that one S3 buckets
‫that the application is using.
‫So you've done everything I said in this course
‫you're doing the minimum permissions.
‫You're creating EC2 instance profiles
‫and something happens, right?
‫You've incite it.
‫And then even though the instance profile was assigned
‫to the EC2 instance,
‫it still has access to all the S3 buckets.
‫The question is, why?
‫So from what I've said, can you guess the answer?
‫Well, the answer is that the credentials chain
‫is still giving priorities
‫to the environment variables that you've set from before.
‫So the only way for you to get rid of them
‫is to unset these environment variables.
‫And then by looking into the credentials change priority
‫it will at the end leverage the EC2 instance profile
‫and the permissions that come out of it.
‫So this is a common scenario question
‫and hopefully that makes sense for you.
‫So credentials best practices though,
‫never, ever, ever, ever store your credentials in your code.
‫That is extremely bad practice.
‫The best practice is for the credentials
‫to be inherited from the credentials chain.
‫So that means that if you're working
‫within AWS use IAM roles as much as possible.
‫That means that you must use ECS instance role
‫for EC2 instances or ECS roles for ECS tasks
‫or as we'll see Lambda roles for Lambda functions.
‫You get the idea.
‫Within AWS use IAM roles as much as possible.
‫If you're working outside of AWS,
‫then use the environment variables
‫or named profile just like we've been doing
‫when we configured our CLI, okay.
‫But never, ever, ever store your credentials
‫directly in your code.
‫That is horrible practice.
‫So that's it.
‫Hope that was helpful.
‫And I will see you in the next lecture.