Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is writing a Python application using the AWS SDK for Python (Boto3) to upload files to an Amazon S3 bucket. During local development, the application must use credentials from a shared credentials file under a profile named 'local-dev'. Once deployed to an Amazon ECS task on AWS Fargate, the application must assume the ECS task role to access the S3 bucket. The developer wants to avoid making any code changes when transitioning the application from the local environment to AWS Fargate. Which configuration approach should the developer use to meet these requirements?

  1. Initialize the S3 client using `boto3.client('s3')` without specifying credentials or profiles in the code, and configure the `AWS_PROFILE` environment variable on the local workstation.Answer
  2. B
    Initialize the S3 client by passing the profile name directly in the code using `boto3.Session(profile_name='local-dev').client('s3')`, and package the shared credentials file containing that profile inside the container image.
  3. C
    Store the local AWS access keys in the AWS Systems Manager Parameter Store, retrieve them programmatically on application startup, and initialize the client using `boto3.client('s3', aws_access_key_id=..., aws_secret_access_key=...)`.
  4. D
    Modify the trust policy of the ECS task execution role to trust the developer's local IAM user, and configure the application to dynamically call the AWS Security Token Service (STS) to assume the role on startup.

Answer

Initialize the S3 client using `boto3.client('s3')` without specifying credentials or profiles in the code, and configure the `AWS_PROFILE` environment variable on the local workstation.
Initializing the Boto3 client using the default configuration (without passing explicit credentials or profiles) ensures that the SDK uses its default credential provider chain. Setting the `AWS_PROFILE` environment variable on the local machine tells Boto3 to read from the local credentials file under the specified profile. When deployed to AWS Fargate, because that environment variable is not present, the credential chain naturally proceeds to search for ECS task role credentials, enabling a seamless transition without modifying the code.

Step-by-Step Solution

1
Understand the behavior of the default credential provider chain in the AWS SDK for Python (Boto3).
The SDK looks for credentials in a specific sequence: environment variables, shared credentials files, and finally instance/container metadata services.
This allows applications to resolve credentials dynamically based on their environment without modifying code.
2
Configure the local workstation to use the correct profile without hardcoding it.
Set the `AWS_PROFILE` environment variable to 'local-dev'. The Boto3 SDK default client initialization detects this environment variable and reads the corresponding credentials from `~/.aws/credentials`.
This ensures local development uses the correct IAM identity without embedding profile names in the application code.
3
Deploy the application to AWS Fargate using the default Boto3 client initialization.
On Fargate, the `AWS_PROFILE` variable is absent, so the Boto3 default chain automatically looks for credentials from the ECS task role via the container metadata service.
This achieves seamless transition between local development and production with zero code changes.

Key Concept

AWS SDK Default Credential Provider Chain Resolution
Estimated Time:1m 30s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic