Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is troubleshooting a Python application on a local development workstation. The application uses the AWS SDK for Python (Boto3) to interact with AWS resources.

The developer has configured two profiles in the local `~/.aws/credentials` file: a `default` profile and a `custom-dev` profile.

To test the application locally, the developer runs the following commands in the terminal:

bash
export AWS_PROFILE=custom-dev
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

When the developer runs the application, they notice that the SDK uses the IAM credentials from the environment variables rather than the configuration defined for `custom-dev` in the credentials file.

Why does the AWS SDK execute the requests using the environment variable credentials instead of the `custom-dev` profile?

  1. The AWS SDK credential provider chain evaluates environment variables for explicit access keys before loading credentials from the shared credentials file.Answer
  2. B
    The AWS_PROFILE environment variable is only recognized by the AWS CLI, whereas the AWS SDK ignores it and defaults to environment variables.
  3. C
    The shared credentials file is only read if the environment variables for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are not set, but the configuration requires setting AWS_SDK_LOAD_CONFIG=true to prioritize the credentials file.
  4. D
    The AWS SDK requires the trust policy of the IAM role in the custom-dev profile to explicitly allow local execution before it can override environment variables.

Answer

The AWS SDK credential provider chain evaluates environment variables for explicit access keys before loading credentials from the shared credentials file.
The AWS SDK default credential provider chain resolves credentials in a specific sequence. Environment variables containing explicit access keys (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) are checked before looking up the shared credentials file. As long as these environment variables are defined in the environment, the SDK will use them, ignoring the profile specified by AWS_PROFILE.

Step-by-Step Solution

1
Analyze the credentials configured in the environment and the shared credentials file.
The terminal has both environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and the AWS_PROFILE environment variable set to select a profile from the credentials file.
Understanding which credential configurations are active is necessary to diagnose the lookup behavior.
2
Review the order of precedence in the AWS SDK default credential provider chain.
The chain searches environment variables first, then credentials from the shared credentials/config files (controlled by AWS_PROFILE).
The SDK resolves credentials by checking sources in a strict, pre-defined order.
3
Compare the precedence of the active credential sources.
Because AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are defined in the environment variables, they take precedence over the AWS_PROFILE setting.
This explains why the SDK ignores the profile configuration and uses the direct environment variables.

Key Concept

AWS SDK Default Credential Provider Chain Precedence
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic