Examkin

Question

Difficulty: HardAWS SDKs and Credential Management

A developer is running a containerized Java application inside an Amazon Elastic Container Service (Amazon ECS) task on an Amazon EC2 host. The ECS task is assigned an IAM Task Role (`ECS-Task-Role`) that has permission to write to an Amazon DynamoDB table. The hosting EC2 instance profile has an IAM role (`EC2-Host-Role`) that does not have DynamoDB permissions.

During execution, the application fails to write to DynamoDB and logs an `AccessDeniedException`. Further inspection of the log output shows that the AWS SDK is resolving credentials associated with `EC2-Host-Role` rather than `ECS-Task-Role`.

Which of the following is the most likely root cause of this credential resolution behavior?

  1. A
    The developer hardcoded placeholder credentials in the AWS SDK client initialization builder, causing the SDK to bypass the default credential provider chain entirely.
  2. B
    The DynamoDB write permissions were attached to the ECS Task Execution Role instead of the ECS Task Role, forcing the ECS container agent to fall back to the host's instance profile for application execution.
  3. The environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` was not injected into the container, causing the AWS SDK to bypass the ECS task credentials step in the provider chain and fall back to the host instance profile credentials.Answer
  4. D
    The trust relationship policy of `ECS-Task-Role` was misconfigured to trust `ecs.amazonaws.com` instead of `ecs-tasks.amazonaws.com`, preventing the EC2 host from assuming the task role and defaulting to its own role.

Answer

The correct answer states that the environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` was not injected into the container, causing the AWS SDK to bypass the ECS task credentials step in the provider chain and fall back to the host instance profile credentials.
The correct answer is correct because the AWS SDK's Default Credential Provider Chain relies on the environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` to discover and fetch temporary credentials for the ECS Task Role from the ECS agent. If this environment variable is missing, the SDK assumes it is not running in an ECS task context that supports container credentials and proceeds down the chain, eventually resolving the host EC2 instance's credentials via the Instance Metadata Service (IMDS). Since the host EC2 instance profile has `EC2-Host-Role` attached, which lacks DynamoDB permissions, the application receives an `AccessDeniedException` when trying to write to DynamoDB.

Step-by-Step Solution

1
Identify the credential provider chain precedence for AWS SDK applications running inside an ECS environment.
The AWS SDK checks for ECS container credentials (using the presence of `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` or `AWS_CONTAINER_CREDENTIALS_FULL_URI`) before it checks the EC2 Instance Metadata Service (IMDS).
This ensures containerized tasks use their own specific roles rather than the host's IAM role.
2
Analyze why the SDK bypassed the ECS task credentials and resolved the host instance's credentials.
Since the SDK resolved the `EC2-Host-Role` (retrieved via IMDS), the ECS container credentials step must have been bypassed because the required environment variable `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` was missing or not populated.
Without this environment variable, the SDK assumes it is not running in an ECS task context that supports container credentials and falls back to IMDS.
3
Differentiate between task role configuration errors and SDK fallbacks.
Misconfiguring IAM trust policies or task execution roles would not prevent the container agent from injecting the environment variable. Only the absence of the environment variable triggers the SDK to fall back directly to IMDS.
To resolve this, the network configuration or the ECS agent configuration on the host must be corrected to ensure the environment variables are successfully injected.

Key Concept

AWS SDK Default Credential Provider Chain Precedence in Containerized Environments
Estimated Time:2m 0s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic