Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is writing a Java application that will use the AWS SDK for Java to write data to an Amazon DynamoDB table. During local development, the application must run on the developer's workstation and connect to a development DynamoDB table. In production, the application will run on an Amazon EC2 instance and must connect to a production DynamoDB table. The developer wants to use the default credential provider chain so that the application can automatically discover and use the appropriate credentials in each environment without any code changes.

Which two configuration steps should the developer perform to meet these requirements?

  1. Attach an IAM role with the required DynamoDB permissions to the EC2 instance as an instance profile.Answer
  2. Create a shared credentials file on the local workstation at ~/.aws/credentials containing the development AWS credentials.Answer
  3. C
    Initialize the SDK client by passing the development AWS access keys directly into the client constructor.
  4. D
    Store the development AWS credentials as a plaintext parameter in Systems Manager Parameter Store and configure the SDK client to fetch them.
  5. E
    Add the required DynamoDB API actions directly to the trust policy of the EC2 instance's IAM role.

Answer

Attach an IAM role with the required DynamoDB permissions to the EC2 instance as an instance profile, and create a shared credentials file on the local workstation at ~/.aws/credentials containing the development AWS credentials.
The standard approach for environment-agnostic SDK client initialization is to rely on the default credential provider chain. Locally, the developer configures a shared credentials file at ~/.aws/credentials, which is automatically read by the chain. In the EC2 production environment, the developer attaches an IAM role with the correct permissions to the instance profile, which the chain resolves via the Instance Metadata Service (IMDS). Together, these steps satisfy the credential requirements without hardcoding or code alterations.

Step-by-Step Solution

1
Configure local credentials by creating the ~/.aws/credentials file containing the development access keys.
The local Java application resolves these credentials via the default credential provider chain during development.
The default credential provider chain checks the shared credentials file when environment variables are not set.
2
Create an IAM role with a policy allowing DynamoDB actions and attach it as an instance profile to the EC2 instance.
The EC2 instance gains authorization to access DynamoDB.
The EC2 Instance Metadata Service (IMDS) hosts the credentials associated with the instance profile.
3
Initialize the DynamoDB client in the application code without specifying credentials in the builder or constructor.
The application code remains environment-agnostic.
The default credential provider chain resolves the ~/.aws/credentials file locally and the instance profile on EC2 automatically.

Key Concept

The AWS SDK default credential provider chain automatically discovers credentials in a defined order of precedence, enabling environment-agnostic code deployment.
Estimated Time:1m 30s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic