Examkin

Question

Difficulty: HardTroubleshooting Local Development and AWS Credentials

A developer is containerizing a Java application that uses the AWS SDK for Java v2 to read objects from an Amazon S3 bucket. Access to the bucket requires assuming an IAM role. The developer has configured the local development host's `~/.aws/config` file with a profile named `dev-role` that specifies a `role_arn` and a `source_profile`. Running the AWS CLI command `aws s3 ls --profile dev-role` on the host machine successfully lists the bucket contents. However, when the Java application is run inside a local Docker container using the environment variable `AWS_PROFILE=dev-role`, the application fails with a `SdkClientException` indicating that credentials cannot be loaded.

Which two actions should the developer take to resolve this issue? (Choose two.)

  1. Mount the host's `~/.aws` directory to the home directory of the user running the application inside the container.Answer
  2. Add the `software.amazon.awssdk:sts` dependency to the application's build file (e.g., `pom.xml`).Answer
  3. C
    Hardcode the AWS Access Key ID and Secret Access Key associated with the target IAM role in the S3 client initialization code.
  4. D
    Modify the IAM trust policy of the target IAM role to trust the private IP address of the local Docker container.
  5. E
    Configure the application to bootstrap credentials from AWS Systems Manager Parameter Store by configuring a custom credential provider.

Answer

Mount the host's `~/.aws` directory to the container user's home directory and add the `software.amazon.awssdk:sts` dependency to the application's build file.
The containerized application needs access to the host's AWS credentials configuration, which can be achieved by mounting the host's `~/.aws` directory to the container. Additionally, the AWS SDK for Java v2 requires the `software.amazon.awssdk:sts` dependency to assume the IAM role defined in the profile configuration. Together, these two steps satisfy the credentials requirement without violating security best practices.

Step-by-Step Solution

1
Diagnose container isolation.
Identify that the local container has an independent filesystem and cannot read the host's `~/.aws/config` or `~/.aws/credentials` files.
Resolving the profile depends on accessing these configuration files from within the container's execution context.
2
Mount the credentials directory.
Map the host's `~/.aws` directory to the container user's home directory.
This allows the default credentials provider chain inside the container to read the configuration profiles.
3
Check SDK classpath dependencies.
Identify that the Java SDK v2 requires the STS module to perform the `AssumeRole` call specified in the profile.
Without the STS library, the SDK fails to instantiate the provider needed to assume the role defined by `role_arn`.

Key Concept

AWS SDK credentials resolution, credential file mounting in Docker, and the STS dependency requirement in the AWS SDK for Java v2.
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic