Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is containerizing a Go application that retrieves messages from an Amazon SQS queue. For local testing, the application runs inside a Docker container on a local workstation. The developer has configured the AWS CLI on the host workstation with a default profile, and the CLI successfully connects to SQS. However, when the containerized application runs, it fails with a credentials provider error indicating that no credentials could be found. Which of the following is the most secure and appropriate way to resolve this credential error in the local development environment?

  1. Pass the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables to the container at runtime using the docker run command with environment flags.Answer
  2. B
    Mount the host machine's ~/.aws directory into the container and set the AWS_SDK_LOAD_CONFIG environment variable inside the container to true, so it reads the configuration from the global credentials file before looking at environment variables.
  3. C
    Hardcode the AWS Access Key ID and Secret Access Key into the Go SDK client initialization block of the application code specifically for the local testing phase.
  4. D
    Create an IAM role with the required SQS permissions and configure a trust policy that allows the local container's IP address to assume the role, then update the container's configuration file.

Answer

Pass the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables to the container at runtime using the docker run command with environment flags.
Passing the environment variables to the container at runtime resolves the credentials error because container environments are isolated by default. The default credential provider chain in the AWS SDK checks environment variables first before checking configuration files or IAM roles, allowing the application to successfully retrieve credentials passed via the environment flags.

Step-by-Step Solution

1
Analyze the container execution environment and the SDK credential lookup sequence.
The Go application inside the container runs in an isolated environment and does not inherit environment variables or files from the host machine by default.
Understanding why the SDK is failing to locate credentials.
2
Evaluate the order of precedence in the AWS Default Credential Provider Chain.
The chain first looks for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables before looking at config/credentials files or container/instance metadata endpoints.
Determining the cleanest and most standard way to inject credentials.
3
Select the option that correctly injects the credentials at runtime without violating security guidelines.
Passing the environment variables into the container via the docker run command's environment flags (-e or --env) provides the containerized SDK with the necessary credentials.
Selecting the correct resolution.

Key Concept

AWS SDK Default Credential Provider Chain and Container Environment Isolation
Estimated Time:1m 30s
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic