Examkin

Question

Difficulty: HardAWS SDKs and Credential Management

A developer is packaging a Node.js application to run in an Amazon ECS container on AWS Fargate. During local testing on developer workstations, the application accesses AWS resources using credentials retrieved from the AWS IAM Identity Center (via the AWS CLI `aws sso login` command). In the production Fargate environment, the application must access an Amazon DynamoDB table. The developer wants the application to automatically resolve the correct credentials in both environments using the AWS SDK's default credential provider chain without any code changes or hardcoded credentials.

Which two configuration actions must the developer take to meet these requirements?

  1. Assign the IAM role that has DynamoDB read/write permissions to the ECS Task Role (taskRoleArn) in the ECS task definition.Answer
  2. Set the AWS_PROFILE environment variable on local developer workstations to match the name of the IAM Identity Center profile configured in the shared AWS config file.Answer
  3. C
    Assign the IAM role that has DynamoDB read/write permissions to the ECS Task Execution Role (executionRoleArn) in the ECS task definition.
  4. D
    Configure the IAM role's trust policy to allow the ec2.amazonaws.com service principal to assume the role.
  5. E
    Configure the application to retrieve temporary credentials from AWS Systems Manager Parameter Store and initialize the SDK client directly with those credentials.

Answer

Assigning the IAM role with DynamoDB access to the Task Role (taskRoleArn) in the task definition, and setting the AWS_PROFILE environment variable on local developer workstations to match the name of the IAM Identity Center profile in the shared AWS configuration file.
The correct configurations involve using the ECS Task Role (taskRoleArn) to delegate application permissions in Fargate, and setting the AWS_PROFILE environment variable locally to direct the SDK's default credential provider chain to the correct SSO profile in the shared AWS configuration file. This allows the application code to remain environment-agnostic, resolving credentials automatically using the default provider chain.

Step-by-Step Solution

1
Identify the credential source for the application running in the production ECS Fargate environment.
The application should use the ECS Task Role, which exposes temporary credentials to the container environment.
The SDK's default credential provider chain automatically queries container credentials when running inside an ECS task, provided a Task Role is defined via taskRoleArn.
2
Identify the local credential source generated by AWS IAM Identity Center.
The AWS CLI stores IAM Identity Center login credentials in a local profile within the shared AWS config file.
Setting the AWS_PROFILE environment variable instructs the default credential provider chain to use the specified profile configuration instead of default environment keys.
3
Exclude incorrect role assignments and trust policies.
The Task Execution Role cannot be used for application-level DynamoDB access, and the trust policy must trust ecs-tasks.amazonaws.com rather than ec2.amazonaws.com.
Task Execution Roles only support container-agent operations, and Fargate tasks run on managed container hosts, requiring the ECS-specific trust relationship.

Key Concept

AWS SDK Default Credential Provider Chain and Container Credential Resolution
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic