Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is deploying a containerized application to Amazon ECS on Amazon EC2. The application uses the AWS SDK to write data to an Amazon DynamoDB table. During local testing, the developer used a shared credentials file located at `~/.aws/credentials` inside the container. After deployment, the application fails to authenticate with DynamoDB because the SDK is still using the expired local credentials instead of the assigned ECS Task Role.

Which two actions should the developer take to resolve this issue and ensure the application correctly and securely utilizes IAM roles for authentication? (Select TWO.)

  1. Remove the shared credentials file from the container image.Answer
  2. Ensure the ECS task is configured with a Task Role that has the required DynamoDB permissions, allowing the ECS agent to inject the container credentials environment variable.Answer
  3. C
    Hardcode the AWS access key and secret access key in the SDK client constructor.
  4. D
    Modify the EC2 instance profile's trust policy to allow the ECS task execution role to assume it.
  5. E
    Save the AWS credentials in AWS Systems Manager Parameter Store and retrieve them using the SDK at startup.

Answer

Remove the shared credentials file from the container image, and ensure the ECS task is configured with a Task Role that has the required DynamoDB permissions, allowing the ECS agent to inject the container credentials environment variable.
The AWS SDK credential provider chain prioritizes shared credentials files over ECS container credentials. Removing the local shared credentials file allows the chain to fall back to the container credentials provider. Ensuring that the task has an ECS Task Role configured allows the ECS agent to set the necessary container credentials environment variable, enabling the SDK to obtain temporary IAM credentials.

Step-by-Step Solution

1
Analyze the AWS SDK credential provider chain order of precedence.
The SDK looks for credentials first in environment variables, then in the shared credentials file (e.g., ~/.aws/credentials), then in ECS task credentials (via environment variables injected by the ECS agent), and finally in the EC2 instance profile.
Understanding the lookup order helps identify why the expired credentials in the container image are overriding the ECS Task Role.
2
Remove the overriding credential source.
By removing the ~/.aws/credentials file from the container image, the SDK will no longer find local credentials and will fall back to subsequent options in the chain.
This allows the credential provider chain to continue evaluating down to the container credentials.
3
Verify and apply the ECS Task Role configuration.
Assigning a Task Role to the ECS task definition causes the ECS agent to automatically inject the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable, which the SDK uses to fetch temporary credentials.
This provides the application with secure, temporary, and automatic credential rotation.

Key Concept

AWS SDK Credential Provider Chain Precedence
Estimated Time:2m 0s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic