Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is troubleshooting a local Node.js application that uses the AWS SDK for JavaScript (v3) to query an Amazon DynamoDB table. The local development machine has the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` set to credentials of a retired testing account, which causes authentication failures. The developer has a local shared credentials file (`~/.aws/credentials`) with a profile named `local-dev` that contains active credentials for the development environment. The client is initialized in the code as follows:

javascript
import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
const client = new DynamoDBClient({});

Which of the following actions will resolve this credential resolution issue and ensure the application authenticates using the `local-dev` profile? (Select TWO.)

  1. Unset the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables, and set the `AWS_PROFILE` environment variable to `local-dev`.Answer
  2. Import the `fromIni` credential provider from `@aws-sdk/credential-providers` and pass it to the `credentials` configuration option of the `DynamoDBClient` constructor, specifying the `local-dev` profile.Answer
  3. C
    Set the `AWS_DEFAULT_PROFILE` environment variable to `local-dev` and verify that the `AWS_PROFILE` environment variable is unset.
  4. D
    Initialize the `DynamoDBClient` by hardcoding the `local-dev` access key ID and secret access key directly into the client constructor configuration object.
  5. E
    Store the `local-dev` credentials as a `SecureString` parameter in AWS Systems Manager Parameter Store, and set the `AWS_SSM_CREDENTIALS_PATH` environment variable to point to the parameter.

Answer

To resolve the credential resolution issue, the developer can either unset the credentials environment variables and set the profile environment variable to specify the profile, or configure the client explicitly using the `fromIni` provider from the credential providers library to load the profile.
To resolve the credential resolution issue, the developer can either clean up the environment or configure the application client explicitly. In the default credential provider chain, environment variables containing credentials have the highest precedence. Therefore, removing the retired credentials environment variables and setting the profile environment variable forces the SDK to fall back to the shared credentials file and load the specified profile. Alternatively, explicitly configuring the client constructor with the `fromIni` provider overrides the default provider chain entirely, forcing the application to load the local-dev profile credentials directly from the local configuration files.

Step-by-Step Solution

1
Analyze the AWS SDK credential provider chain precedence.
Identify that environment variables containing credentials take precedence over configuration profiles and the shared credentials file.
This explains why the application uses the retired credentials instead of the local-dev profile.
2
Determine how to modify the environment to allow profile-based authentication.
Unsetting the credentials environment variables enables the SDK to fall back to the shared credentials file, where the profile specified by the profile environment variable will be used.
This allows the default chain to resolve the local-dev profile credentials.
3
Determine how to modify the application code to explicitly bypass the default credential provider chain.
Import and use the `fromIni` provider from `@aws-sdk/credential-providers` to explicitly load credentials from the local-dev profile.
This overrides the default credential provider chain and avoids using the environment variables.

Key Concept

AWS SDK credential provider chain precedence and local profile configuration.
Estimated Time:2m 0s
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic