Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is running a Python application locally using the AWS SDK for Python (Boto3) to retrieve objects from an Amazon S3 bucket.

The developer's local terminal has the following environment variables configured:

bash
export AWS_ACCESS_KEY_ID=AKIA111111111EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_PROFILE=staging

The shared AWS credentials file (`~/.aws/credentials`) contains:

ini
[staging]
aws_access_key_id = AKIA222222222EXAMPLE
aws_secret_access_key = userSecretKeyStagingExample

The application code is initialized as follows:

python
import boto3
s3 = boto3.client('s3')
response = s3.list_objects_v2(Bucket='my-staging-bucket')

When the developer runs the application, it fails with an `AccessDenied` error. The IAM user represented by `AKIA111111111EXAMPLE` does not have access to the S3 bucket, but the IAM user in the `staging` profile (`AKIA222222222EXAMPLE`) has full S3 permissions.

What is the reason for this failure, and how should the developer resolve it?

  1. A
    The default credential provider chain ignores environment variables when a profile is specified. The developer must modify the application code to hardcode the credentials by passing the aws_access_key_id and aws_secret_access_key parameters directly to the client constructor.
  2. B
    The staging profile credentials cannot be used locally because the IAM user has not configured a trust policy that allows the local workstation's IP address. The developer must add a trust policy to the IAM user permitting access from the local public IP.
  3. The default credential provider chain evaluates the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables before evaluating AWS_PROFILE. The developer should unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal.Answer
  4. D
    The SDK requires local developer credentials to be retrieved dynamically from Systems Manager Parameter Store with automatic rotation configured. The developer must migrate the local credentials to Parameter Store and fetch them in the code.

Answer

The default credential provider chain evaluates the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables before evaluating AWS_PROFILE. The developer should unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal.
The correct answer explains that the AWS SDK's default credential provider chain resolves explicit credentials set in environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) prior to checking the profile configuration via the AWS_PROFILE environment variable. Unsetting the direct credential environment variables allows the SDK to process the rest of the provider chain, falling back to the credentials file to load the staging profile's authorized keys.

Step-by-Step Solution

1
Analyze the SDK's credential provider chain precedence.
The AWS SDK checks credentials in a specific order: first direct client parameters, then environment variables (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY), and then the shared credentials file using the profile set in AWS_PROFILE.
To identify which credentials the Boto3 client is actually loading at runtime.
2
Identify the conflict between active environment variables.
Because AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set, the SDK uses them immediately and never looks at the staging profile specified by AWS_PROFILE.
To explain why the unauthorized credentials (AKIA111111111EXAMPLE) are being used instead of the staging credentials.
3
Remove the overriding environment variables.
Unsetting AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the terminal forces the credential provider chain to fall back to reading ~/.aws/credentials for the 'staging' profile.
To resolve the credential conflict and allow the application to authenticate using the correct credentials.

Key Concept

AWS SDK Default Credential Provider Chain Precedence
Estimated Time:1m 30s
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic