Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is deploying a Node.js application to Amazon ECS on AWS Fargate. The application needs to read messages from an Amazon SQS queue. The developer has created an IAM Task Role with the necessary permissions and associated it with the ECS Task. However, when the application runs in ECS, it throws a credentials error stating that it cannot load credentials. The developer discovers that the application task definition has residual `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables set to empty values, which were used during local Docker container testing.

Which of the following actions should the developer take to resolve this issue and follow AWS security best practices? (Select TWO.)

  1. Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS task definition.Answer
  2. Verify that the application's SDK client initialization relies on the default credential provider chain.Answer
  3. C
    Attach the SQS permissions to the ECS Task Execution Role instead of the ECS Task Role.
  4. D
    Configure the ECS container to query the EC2 Instance Metadata Service (IMDSv2) to retrieve credentials.
  5. E
    Package the developer's local AWS credentials file inside the Docker image under the ~/.aws/credentials path.

Answer

The developer should remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the task definition, and ensure the SDK client utilizes the default credential provider chain.
Removing the empty environment variables from the task definition allows the SDK default credentials provider chain to proceed past the environment variable stage. Because the application is running in an ECS task, the SDK then queries the container credentials endpoint to assume the IAM Task Role. The client initialization must also rely on the default provider chain, which automatically supports this resolution.

Step-by-Step Solution

1
Analyze the credentials error and the task configuration.
Identify that the presence of empty AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables interrupts the default credentials provider chain before it checks container credentials.
The SDK's default credentials provider chain evaluates environment variables before container credentials. When key variables are present but empty or invalid, the SDK fails instead of falling back.
2
Remove the invalid environment variables from the ECS task definition.
Allows the default credentials provider chain to bypass the environment variable stage and move to the ECS container credentials stage.
This exposes the container credentials relative URI, which is used by the default credentials provider to assume the IAM Task Role.
3
Ensure the application code initializes clients using the default chain.
The SDK will correctly locate the credentials automatically from the ECS container metadata environment.
Hardcoding credentials or credentials file configurations in containerized applications violates security and configuration best practices.

Key Concept

Default Credential Provider Chain Precedence
Estimated Time:1m 30s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic