Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is troubleshooting a Python application running on a local workstation. The application uses the AWS SDK for Python (Boto3) to read objects from an Amazon S3 bucket. To configure the correct development credentials, the developer creates a profile named 'dev-profile' in the local ~/.aws/credentials file and sets the environment variable AWS_PROFILE=dev-profile in the terminal. However, when executing the script, the developer receives an AccessDenied error indicating that access is denied for an old, incorrect IAM user that is not defined in the 'dev-profile'. Which of the following is the most likely cause of this behavior?

  1. Active AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are set in the terminal session, which take precedence over the AWS_PROFILE environment variable.Answer
  2. B
    The Boto3 client initialization code explicitly specifies hardcoded, expired access keys in its parameters, which overrides the profile configuration.
  3. C
    The local workstation's IP address is not explicitly authorized under an IAM trust policy, which prevents Boto3 from reading profiles in the shared credentials file.
  4. D
    The application is attempting to retrieve access credentials from Systems Manager Parameter Store instead of AWS Secrets Manager, causing a fallback to default credentials.

Answer

Active AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are set in the terminal session, which take precedence over the AWS_PROFILE environment variable.
The correct option is correct because the AWS SDK credential provider chain evaluates explicit credential environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) before the shared credentials file. If these environment variables are set in the active terminal session, Boto3 will use them and ignore the profile specified by the AWS_PROFILE environment variable.

Step-by-Step Solution

1
Evaluate the AWS SDK credential provider chain order.
The SDK looks first for credentials passed directly to the client constructor, followed by environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN), and then shared configuration and credential files (referenced by AWS_PROFILE).
This establishes which credential source takes precedence when multiple sources are configured.
2
Analyze the conflicting configurations in the scenario.
The developer configured AWS_PROFILE in the environment, but the application is still authenticating as an incorrect, old IAM user.
This indicates that a credential source with higher precedence than the credentials file (such as active credential environment variables) is active in the environment and overriding the AWS_PROFILE selection.
3
Identify the corrective action.
Unsetting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal session will allow the SDK to fall back to the credentials file and load the 'dev-profile' profile specified by AWS_PROFILE.
Removing the higher-precedence environment variables allows the lower-precedence profile credentials to be resolved successfully.

Key Concept

AWS SDK Credential Provider Chain Precedence
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic