Examkin

Question

Difficulty: EasyAWS SDKs and Credential Management

A developer is deploying a Go-based microservice to AWS Lambda. The microservice uses the AWS SDK for Go to retrieve items from an Amazon DynamoDB table.

Which of the following is the most secure and standard way to configure the AWS SDK client to authenticate requests?

  1. Initialize the SDK client using the default configuration settings so it automatically inherits permissions from the Lambda function's execution role.Answer
  2. B
    Pass a hardcoded AWS Access Key ID and Secret Access Key into the SDK client configuration constructor.
  3. C
    Store long-lived IAM User credentials in Systems Manager Parameter Store as a plain text string and fetch them at client initialization.
  4. D
    Update the trust policy of the Lambda execution role to allow DynamoDB to assume the role instead of attaching a permissions policy.

Answer

Initialize the SDK client using the default configuration settings so it automatically inherits permissions from the Lambda function's execution role.
The correct option is to initialize the SDK client using default configuration settings. When running inside AWS Lambda, the AWS SDK automatically utilizes the Default Credential Provider Chain to retrieve the temporary credentials associated with the function's execution role from the environment. This is the most secure approach because it avoids hardcoding secrets and relies on temporary, automatically rotated credentials.

Step-by-Step Solution

1
Examine the deployment environment of the application, which is AWS Lambda.
Identify that AWS Lambda automatically provides temporary security credentials to the execution environment via environment variables.
Understanding the execution environment helps determine if temporary credentials are automatically available.
2
Analyze how the AWS SDK retrieves credentials when initialized with default settings.
The AWS SDK's Default Credential Provider Chain automatically checks for credentials in environment variables, which is where Lambda places the execution role's temporary credentials.
This allows the developer to write code that does not reference any specific credentials directly.
3
Select the option that initializes the client using default configurations without hardcoding or manually fetching long-lived secrets.
Initializing the client with default configuration is the most secure and standard approach.
This aligns with AWS security best practices by utilizing short-lived IAM credentials automatically managed by AWS.

Key Concept

AWS SDK Default Credential Provider Chain and Lambda Execution Roles
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic