Examkin

Question

Difficulty: EasyAWS SDKs and Credential Management

A developer is configuring a local workstation to run a script that uses the AWS SDK to retrieve files from Amazon S3. To adhere to security best practices and avoid hardcoding credentials within the application, which two locations can the developer use to store the credentials so they are automatically detected by the default credential provider chain? (Select TWO.)

  1. Environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY)Answer
  2. The shared credentials file (typically located at ~/.aws/credentials on Linux/macOS)Answer
  3. C
    The initialization parameters of the S3 client constructor as hardcoded string parameters
  4. D
    An IAM trust policy document saved in a file named trust-policy.json in the application's root directory
  5. E
    An encrypted parameter in Systems Manager Parameter Store named aws_credentials

Answer

The developer should store the credentials in environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) or in the shared credentials file (~/.aws/credentials).
The correct options are environment variables and the shared credentials file because both are standard, secure ways to supply credentials that the AWS SDK's default credential provider chain automatically evaluates during initialization.

Step-by-Step Solution

1
Analyze how the AWS SDK's default credential provider chain searches for credentials on a local system.
The chain looks at environment variables first, then at system properties (for Java), and then at the shared credentials file (~/.aws/credentials).
Understanding the order of precedence in the credential chain helps identify where credentials can be placed for automatic detection.
2
Evaluate the option of using environment variables.
Defining AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY enables the SDK to load credentials automatically.
Environment variables are the first place the default chain looks, making it a valid and common local configuration method.
3
Evaluate the option of using the shared credentials file.
Storing credentials under the default profile in ~/.aws/credentials allows the SDK to load them without code modification.
The shared credentials file is specifically designed for local development credentials and is checked by the default chain.

Key Concept

The default credential provider chain automatically searches standard locations (like environment variables and the shared credentials file) in a specific order to obtain AWS credentials, eliminating the need to hardcode sensitive keys.
Estimated Time:1m 0s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic