Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer has deployed a containerized Node.js application to Amazon ECS on AWS Fargate. The application uses the AWS SDK for JavaScript (v3) to read from an Amazon DynamoDB table. The ECS task is configured with an IAM Task Role that has the required DynamoDB permissions. However, the application fails to query the table, and the developer receives an authentication error from DynamoDB. During debugging, the developer notices that the container definition still includes the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` set to mock values used during local testing.

Which of the following explains why the application is failing to access DynamoDB, and what is the correct resolution?

  1. A
    The application fails because permissions to access DynamoDB must be attached to the ECS Task Execution Role rather than the ECS Task Role. To resolve this, attach the required IAM policy to the Task Execution Role and remove the environment variables.
  2. B
    The default credential provider chain does not automatically resolve ECS container credentials unless explicitly configured in code. To resolve this, modify the SDK client initialization to instantiate the DynamoDB client using the container credentials provider class.
  3. The AWS SDK default credential provider chain evaluates environment variables before checking for ECS container credentials. The SDK signed requests using the mock environment variables, leading to authentication failures. To resolve this, remove the mock environment variables from the container definition.Answer
  4. D
    The ECS Task Role is missing a custom policy mapping the environment variables to the container agent's IAM role. To resolve this, update the IAM trust policy to trust the ECS service principal and set the container's environment variables to read-only.

Answer

The AWS SDK default credential provider chain evaluates environment variables before checking for ECS container credentials. The SDK signed requests using the mock environment variables, leading to authentication failures. To resolve this, remove the mock environment variables from the container definition.
The correct answer explains that the AWS SDK's default credential provider chain searches environment variables before any other credential sources. If mock or placeholder credentials exist in the environment, the SDK selects them immediately and attempts to use them to sign requests, resulting in authentication failures. Removing the mock variables allows the default provider chain to evaluate subsequent options and retrieve the ECS Task Role credentials.

Step-by-Step Solution

1
Analyze the SDK default credential provider chain resolution order.
The chain evaluates environment variables first, then system properties, then local configuration files, then ECS container credentials (if available), and finally EC2 instance metadata.
This establishes which credential source is selected when multiple sources are present in the environment.
2
Identify the cause of the authentication failure based on the presence of mock credentials.
Since `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are present in the environment variables, the SDK uses them immediately and stops searching the chain. It signs API requests with these invalid mock credentials, leading to authentication errors.
This explains why the assigned ECS Task Role is being bypassed.
3
Determine the corrective action to force the SDK to use the ECS Task Role.
Removing the mock environment variables causes the environment provider to be skipped, allowing the SDK to fall back to the ECS container credentials provider which retrieves the temporary credentials linked to the Task Role.
This ensures the default provider chain operates correctly in the Fargate environment.

Key Concept

AWS SDK default credential provider chain precedence
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic