Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is deploying a Python application to Amazon ECS on AWS Fargate. The application uses the AWS SDK for Python (Boto3) to upload objects to an Amazon S3 bucket. During local testing, the developer initialized the S3 client by passing a specific profile name from their local AWS CLI configuration file. In production, the Fargate task is assigned an ECS Task Role with the required S3 permissions, but the application fails to start due to a client initialization error. Which action should the developer take to resolve this issue?

  1. A
    Attach the required S3 permission policy to the ECS Task Execution Role instead of the Task Role, and configure the Boto3 client to request credentials from the task execution environment variables.
  2. B
    Retrieve the access keys and session token of the developer's IAM user, and pass them as hardcoded string arguments when initializing the Boto3 client in the application code.
  3. Initialize the S3 client using the default constructor (for example, `boto3.client('s3')`) without specifying any profile name or credentials, allowing the SDK to use the default credential provider chain to retrieve credentials from the ECS container.Answer
  4. D
    Store the developer's IAM credentials in AWS Systems Manager Parameter Store as a secure string, and configure the application code to retrieve these credentials at startup to initialize the Boto3 client.

Answer

Initialize the S3 client using the default constructor without specifying any profile name or credentials, allowing the SDK to use the default credential provider chain to retrieve credentials from the ECS container.
Initializing the S3 client using the default constructor (for example, `boto3.client('s3')`) allows the AWS SDK to use the default credential provider chain. In an ECS container environment on AWS Fargate, this chain automatically retrieves temporary credentials via the ECS container agent using the ECS Task Role. This eliminates the need to specify a profile name (which is only present in the developer's local AWS CLI configuration) or to manage static credentials in code.

Step-by-Step Solution

1
Remove the explicit profile configuration or credentials from the Boto3 client initialization code.
The client is initialized using the default constructor, enabling the default credential provider chain.
The default credential provider chain dynamically looks for credentials in environment variables, shared credentials files, and ECS container metadata/agent endpoints in a specific order of precedence.
2
Ensure the ECS Task has the appropriate IAM Task Role assigned.
The container agent exposes a credentials endpoint for the task.
Fargate tasks use ECS Task Roles to grant containerized applications permission to interact with other AWS services.
3
Deploy the updated application container to AWS Fargate.
The SDK automatically queries the ECS container agent endpoint and retrieves temporary credentials, granting S3 access.
This matches the AWS security best practice of using temporary, IAM role-based credentials rather than static or hardcoded credentials.

Key Concept

AWS SDK Default Credential Provider Chain and ECS Task Roles
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic