Examkin

Question

Difficulty: EasyTroubleshooting Local Development and AWS Credentials

A developer is troubleshooting a local Python application that uses the Boto3 SDK to retrieve configuration parameters from AWS Systems Manager Parameter Store. The developer previously configured the local machine using the AWS CLI and confirmed that the shared credentials file (~/.aws/credentials) contains valid credentials under the default profile. However, when executing the script in a terminal session, the application returns a signature mismatch error (SignatureDoesNotMatch).

Which of the following is the most likely cause of this error?

  1. A
    The Boto3 SDK requires access keys to be explicitly passed as arguments in the client initialization constructor when running outside of EC2.
  2. B
    The developer must use Secrets Manager instead of Parameter Store because local applications cannot authenticate to Parameter Store without using automatic credential rotation.
  3. The terminal session has invalid or expired credentials set in the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, which override the shared credentials file.Answer
  4. D
    The local machine is missing an IAM trust policy that explicitly grants permission for the local operating system to assume the user's IAM role.

Answer

The terminal session contains active environment variables for AWS credentials that are invalid or expired, overriding the valid credentials configured in the shared credentials file.
The correct answer is correct because the AWS SDK default credential provider chain evaluates environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before it checks the shared credentials file (~/.aws/credentials). If invalid or expired credentials are set in the terminal environment variables, the SDK will attempt to use them and fail, ignoring the valid credentials configured in the default profile of the shared credentials file.

Step-by-Step Solution

1
Analyze the error message and context.
The application returns a SignatureDoesNotMatch error, indicating that the AWS service rejected the signature generated by the SDK using the active credentials.
This error means the request was signed with an incorrect or corrupted access key/secret key combination, rather than missing credentials.
2
Determine the AWS SDK credential provider chain order.
The AWS SDK Default Credential Provider Chain looks for credentials in the following order: 1. Environment variables, 2. Shared credentials file, 3. Container credentials, 4. Instance profile credentials.
Understanding the lookup order helps identify which credentials the SDK actually loaded.
3
Identify the source of the invalid credentials.
Since environment variables have higher precedence than the shared credentials file, any credentials defined as environment variables in the current shell session will be used, even if the shared credentials file has valid credentials.
The presence of invalid environment variables explains why the valid profile credentials were ignored, resulting in the signature mismatch error.

Key Concept

AWS SDK Default Credential Provider Chain Precedence
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic