Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is deploying a Go application to run in an Amazon ECS task using the AWS Fargate launch type. The application uses the AWS SDK to retrieve configuration data from Amazon Systems Manager Parameter Store. The developer wants to ensure that the application can authenticate with AWS services securely during local development and in the production ECS environment without code modifications. Which two actions should the developer take to configure the credential retrieval process correctly? (Select TWO.)

  1. Initialize the AWS SDK client using the default credential provider chain configuration without passing any static credentials.Answer
  2. Associate an IAM role containing the required permissions with the ECS task definition using the taskRoleArn parameter.Answer
  3. C
    Hardcode the AWS Access Key ID and Secret Access Key in the SDK client configuration for local testing, and use container environment variables to pass them in production.
  4. D
    Configure the trust policy of the IAM role to allow the ecs.amazonaws.com service principal to assume the role.
  5. E
    Store the credentials in Systems Manager Parameter Store and configure automatic rotation, since Parameter Store natively supports credential rotation like AWS Secrets Manager.

Answer

Initialize the AWS SDK client using the default credential provider chain configuration without passing any static credentials, and associate an IAM role containing the required permissions with the ECS task definition using the taskRoleArn parameter.
To authenticate securely without code changes across environments, the developer should initialize the AWS SDK client using the default credential provider chain. The chain automatically searches for credentials in the environment, local configuration files (during local development), and container credentials (ECS Task Roles) when deployed on AWS. The IAM role containing the permissions must be associated with the ECS task definition using the taskRoleArn parameter, allowing the application within the container to retrieve temporary security credentials.

Step-by-Step Solution

1
Configure the AWS SDK client to use the default credential provider chain.
The SDK automatically checks multiple locations for credentials in a specific order: environment variables, shared credentials file, and then the ECS task role credentials.
This allows the same codebase to run locally (using local profiles) and in production (using task roles) without changes.
2
Assign the S3/Parameter Store IAM role to the Task Role parameter (taskRoleArn) in the ECS task definition.
The containerized application is granted permission to call AWS services, and the AWS SDK inside the container can automatically fetch temporary credentials from the ECS container agent.
Permissions required by the application code must be defined in the Task Role, not the Task Execution Role (which is for the ECS agent itself).

Key Concept

AWS SDK Default Credential Provider Chain and ECS Task Roles
Estimated Time:1m 30s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic