Examkin

Question

Difficulty: HardAWS SDKs and Credential Management

A developer has deployed a containerized Node.js application inside a Docker container running on an Amazon EC2 instance. The application uses the AWS SDK for JavaScript to query an Amazon DynamoDB table. An IAM role with the necessary permissions is attached to the EC2 instance via an IAM instance profile. The EC2 instance is configured to require Instance Metadata Service Version 2 (IMDSv2).

While the application successfully accesses DynamoDB when executed directly on the EC2 host, it fails with a credential initialization error when running inside the Docker container. The container is running on the default bridge network.

Which of the following actions should the developer take to resolve this credential issue? (Select TWO.)

  1. Modify the EC2 instance metadata options to increase the response hop limit to 2 or more.Answer
  2. Run the Docker container using host network mode by specifying the `--network host` flag.Answer
  3. C
    Generate static IAM access keys for the EC2 instance profile role and pass them as environment variables to the container.
  4. D
    Configure the container environment with the `AWS_ROLE_ARN` environment variable set to the ARN of the EC2 instance profile's IAM role.
  5. E
    Disable IMDSv2 on the EC2 instance and fallback to IMDSv1 to bypass the token request requirements.

Answer

To resolve the credential issue, the developer must either modify the EC2 instance metadata options to increase the response hop limit to 2 or more, or run the Docker container in host network mode using the `--network host` flag.
The credential retrieval failure is caused by the default IMDSv2 response hop limit of 1. When a container runs on the default bridge network, any traffic to the link-local metadata address must cross the container bridge, which counts as an IP hop. Consequently, the metadata response is dropped. The correct actions are to increase the metadata response hop limit to 2 or more on the EC2 instance, or to run the container using host network mode, which eliminates the bridge hop entirely.

Step-by-Step Solution

1
Analyze the execution environment and network path.
The application runs within a container on the default bridge network, which acts as a virtual gateway and introduces an additional IP routing hop between the container and the EC2 host's link-local address.
Understanding the network topology helps identify why packets are dropped.
2
Examine the default IMDSv2 settings.
Under IMDSv2, the default HTTP metadata response hop limit is set to 1. Since the bridge network adds a hop, the TTL of the IP packet containing the token response expires and the packet is dropped before reaching the container.
This explains why the application succeeds on the host but fails in the container.
3
Identify the configuration changes needed to allow containerized access.
Increasing the metadata response hop limit to 2 or more allows the token response to travel through the bridge interface. Alternatively, using host network mode avoids the bridge network hop entirely.
Both methods ensure that the token response successfully reaches the SDK client inside the container.

Key Concept

IMDSv2 Metadata Response Hop Limit in Containerized Environments
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic