Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is troubleshooting a local Node.js application that uses the AWS SDK for JavaScript (v3) to query an Amazon DynamoDB table in a development environment. The developer has configured a local profile named 'dev-profile' in the ~/.aws/credentials file and specified the target region as 'us-west-2' in ~/.aws/config under the same profile. The developer runs the application after setting the AWS_PROFILE environment variable to 'dev-profile'. However, the application fails to connect to the development DynamoDB table, throwing access denied errors because it is attempting to connect to the us-east-1 region using credentials associated with a production account. Upon checking the environment, the developer discovers that the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION (set to us-east-1) environment variables are also set in the current shell session. Which two actions should the developer take to ensure the local application correctly uses the credentials and region defined in the 'dev-profile' profile?

  1. Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the local shell session.Answer
  2. Unset the AWS_REGION environment variable in the local shell session.Answer
  3. C
    Hardcode the AWS access keys directly in the DynamoDB client initialization options in the application code.
  4. D
    Modify the trust policy of the production IAM role to allow the local workstation's public IP address to assume the role.
  5. E
    Store the development access keys as plaintext strings in AWS Systems Manager Parameter Store and retrieve them during application initialization.

Answer

Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the local shell session, and unset the AWS_REGION environment variable in the local shell session.
Unsetting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables forces the AWS SDK credentials provider chain to fall back to the next source, which is the shared credentials file profile indicated by AWS_PROFILE. Similarly, unsetting the AWS_REGION environment variable allows the SDK to read the region property defined under the profile configuration in ~/.aws/config instead of being overridden by the environment.

Step-by-Step Solution

1
Analyze the AWS SDK credential provider chain resolution order.
The SDK checks environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before checking shared credentials files.
Because credentials environment variables are set, they override the AWS_PROFILE setting, causing the application to use production credentials.
2
Analyze the AWS SDK region configuration resolution order.
The SDK checks the AWS_REGION environment variable before checking profile-specific configurations in ~/.aws/config.
Because the AWS_REGION environment variable is set to us-east-1, it overrides the us-west-2 setting specified in the dev-profile profile.
3
Unset the overriding environment variables in the active shell environment.
The environment variables are cleared, and the SDK successfully falls back to retrieving credentials and region configuration from the dev-profile configurations.
Clearing the environment variables enables the default provider chain to locate and use the profile settings correctly.

Key Concept

AWS SDK Credential and Configuration Resolution Precedence
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic