Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is writing a Node.js application on a local development workstation that uses the AWS SDK for JavaScript (v3) to access resources in a development AWS account. To comply with security best practices, the developer must run the application locally by assuming a specific IAM role (arn:aws:iam::123456789012:role/DevDeveloperRolearn:aws:iam::123456789012:role/DevDeveloperRole) using the temporary credentials of a local IAM user profile named `dev-user`.

Which combination of configuration steps will allow the AWS SDK to automatically assume the target IAM role and retrieve temporary credentials without modifying the application code? (Select TWO.)

  1. Define a profile in the local `~/.aws/config` file that specifies the target role's ARN in the `role_arn` parameter and references `dev-user` in the `source_profile` parameter.Answer
  2. Set the `AWS_PROFILE` environment variable in the local development environment to the name of the newly defined profile before running the application.Answer
  3. C
    Add the `role_arn` and `source_profile` parameters under the `[dev-user]` section within the shared credentials file (`~/.aws/credentials`).
  4. D
    Use the AWS SDK inside the application code to explicitly invoke the AWS STS `AssumeRole` API, then pass the returned access keys to the client constructor.
  5. E
    Configure the local `~/.aws/credentials` file to include the `AWS_ROLE_ARN` and `AWS_ROLE_SESSION_NAME` variables under the default profile.

Answer

To configure automatic role assumption without code changes, the developer must define a profile in the local configuration file (`~/.aws/config`) that references the target role ARN and the source profile, and then set the `AWS_PROFILE` environment variable to use this profile.
To assume an IAM role automatically via the AWS SDK without code changes, the developer must utilize profile-based configurations. Specifying the `role_arn` and `source_profile` within the configuration file (`~/.aws/config`) defines how the role is assumed. Setting the `AWS_PROFILE` environment variable directs the SDK to use this profile. When the application initializes the SDK client, the Default Credential Provider Chain reads this environment variable, references the configuration file, and automatically obtains temporary credentials from AWS STS using the source user's credentials.

Step-by-Step Solution

1
Configure the profile in the `~/.aws/config` file.
A profile is created that specifies the target role ARN and links it to the local IAM user profile using the `source_profile` parameter.
This tells the AWS SDK which IAM role to assume and which credentials to use to call the AWS STS `AssumeRole` API.
2
Set the `AWS_PROFILE` environment variable to the name of the newly configured profile.
The local execution environment is configured to point the AWS SDK to the role-assuming profile.
This instructs the Default Credential Provider Chain of the AWS SDK to resolve credentials using the configured role-assumption profile rather than default credentials.

Key Concept

AWS SDK Default Credential Provider Chain and Profile-Based IAM Role Assumption
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic