Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

An application deployed on an Amazon EC2 instance uses the AWS SDK to retrieve secrets from AWS Secrets Manager. The EC2 instance has an IAM instance profile attached with the required permissions. However, when the application runs, it fails to authenticate and throws an AccessDenied exception, attempting to use credentials belonging to a different IAM user. Which of the following is the most likely cause of this credential conflict based on the AWS SDK default credential provider chain order of precedence?

  1. Active environment variables for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are present on the EC2 instance, overriding the EC2 instance profile credentials.Answer
  2. B
    The SDK retrieves credentials from the EC2 Instance Metadata Service (IMDS) which prioritizes the shared credentials file located at ~/.aws/credentials over instance profile roles.
  3. C
    The EC2 instance is trying to use an ECS Task Execution Role that was specified in the application's environment configuration.
  4. D
    The IAM trust policy of the instance profile's role is misconfigured, causing the default credential provider chain to fall back to the IAM user's credentials stored in AWS Systems Manager Parameter Store.

Answer

Active environment variables for AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are present on the EC2 instance, overriding the EC2 instance profile credentials.
The default credential provider chain evaluates environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before checking the EC2 Instance Metadata Service (IMDS). If environment variables from another user are active on the instance, the SDK will use those credentials, ignoring the instance profile.

Step-by-Step Solution

1
Review the AWS SDK default credential provider chain order of precedence.
The chain resolves credentials in the following order: 1. Environment variables, 2. Shared credentials file, 3. Web Identity Token, 4. ECS container credentials, 5. EC2 Instance Metadata Service (IMDS).
This helps identify which source takes priority when multiple credential sources are configured.
2
Compare the precedence of the attached IAM instance profile against other possible sources.
The instance profile credentials are retrieved via IMDS (step 5). Environment variables (step 1) have higher precedence.
Since the SDK is attempting to use credentials of a specific IAM user instead of the instance profile, a higher-precedence source must be supplying those credentials.
3
Identify the configuration that matches the observed failure.
The presence of AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables overrides the instance profile.
Environment variables are evaluated first, meaning any values set there will be preferred over the instance profile credentials.

Key Concept

AWS SDK Default Credential Provider Chain Resolution Order
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic