Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is containerizing a Go application that retrieves database credentials from AWS Secrets Manager using the AWS SDK for Go v2. During local development, the application is run in a Docker container using a non-root user (UID 1000) for security compliance. The developer mounts the host's `~/.aws` folder to `/home/appuser/.aws` inside the container. When the container starts, the application fails to authenticate with AWS and logs a credentials-not-found error.

*Security Notice: Writing plaintext credentials in code or container image definitions is strictly prohibited.*

Which action will resolve this local development credential issue?

  1. Ensure the mounted host `.aws` directory and files have read permissions for UID 1000, and verify the `AWS_SHARED_CREDENTIALS_FILE` environment variable in the container is set to `/home/appuser/.aws/credentials`.Answer
  2. B
    Modify the Go application source code to hardcode temporary credentials dynamically parsed from the CLI config output when initializing the SDK client config.
  3. C
    Modify the Secrets Manager resource policy to include an IAM assume role trust policy that automatically trusts the local container's Docker bridge network interface.
  4. D
    Store the database credentials in Systems Manager Parameter Store as standard parameters instead of Secrets Manager to bypass SDK authentication checks when running from a local environment.

Answer

Ensure the mounted host `.aws` directory and files have read permissions for UID 1000, and verify the `AWS_SHARED_CREDENTIALS_FILE` environment variable in the container is set to `/home/appuser/.aws/credentials`.
The correct action is to ensure that the mounted host credentials directory is readable by the container's non-root user (UID 1000) and that the path to the credentials file is explicitly pointed to by the `AWS_SHARED_CREDENTIALS_FILE` environment variable. By default, host file permissions can block the non-root container user from accessing mounted credentials, causing credential resolution failures. Overriding the path via environment variables guarantees the SDK looks at the correct mount path.

Step-by-Step Solution

1
Analyze container execution context and permissions
Identify that the application runs inside the container under UID 1000, but the mounted host `.aws` directory may have host-specific permissions restricting read access to non-root container users.
Permissions of mounted directories from the host must match the container process user ID to allow file reading.
2
Configure SDK path overrides using standard environment variables
Set `AWS_SHARED_CREDENTIALS_FILE` to `/home/appuser/.aws/credentials` to explicitly direct the SDK client configuration loader to the mounted credentials location.
Overriding the shared credentials path ensures the default provider chain looks at the volume mount path regardless of system path resolutions.

Key Concept

AWS SDK credential lookup precedence and volume mount permissions in local containerized development.
Estimated Time:1m 30s
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic