Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is migrating a Python application that processes images in Amazon S3 from a local development workstation to an AWS Lambda function. In the local environment, the developer initialized the SDK session using `session = boto3.Session(profile_name='dev-profile')`. After deploying the code to Lambda, the function execution fails with a `ProfileNotFound: The config profile (dev-profile) could not be found` error.

Which of the following is the most secure and recommended configuration to resolve this error?

  1. Initialize the client using `boto3.client('s3')` without specifying a session or profile, allowing the SDK to retrieve credentials from the Lambda execution role via the default credential provider chain.Answer
  2. B
    Extract the access keys for 'dev-profile' from the local workstation, configure them as custom Lambda environment variables, and initialize the client using `boto3.client('s3', aws_access_key_id=os.environ['ACCESS_KEY'], aws_secret_access_key=os.environ['SECRET_KEY'])`.
  3. C
    Package the local `.aws/credentials` file containing the 'dev-profile' keys inside the Lambda deployment package, and set the `AWS_SHARED_CREDENTIALS_FILE` environment variable to point to its path.
  4. D
    Modify the trust policy of the Lambda execution role to allow the role to assume itself, and configure the code to pass the execution role ARN directly to the `boto3.Session` initialization.

Answer

Initialize the client using `boto3.client('s3')` without specifying a session or profile, allowing the SDK to retrieve credentials from the Lambda execution role via the default credential provider chain.
The correct approach is to initialize the client using `boto3.client('s3')` without specifying a session or profile. When no explicit configuration profile is requested, the AWS SDK default credential provider chain resolves credentials from the environment. In AWS Lambda, the service automatically populates the environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` with temporary credentials from the execution role, which the SDK automatically reads.

Step-by-Step Solution

1
Modify the code to remove the explicit `profile_name` argument from the Boto3 session initialization.
The SDK client is initialized using default parameters: `s3 = boto3.client('s3')`.
This allows the AWS SDK default credential provider chain to execute instead of looking for a specific local profile.
2
Deploy the updated application to AWS Lambda.
The Lambda function runtime receives the execution command.
AWS Lambda injects temporary, rotated credentials associated with the function's execution role into the environment variables.
3
Verify that the SDK automatically retrieves the injected credentials.
The application successfully authenticates and accesses the S3 bucket without throwing credential or profile errors.
The SDK default credential provider chain checks environment variables first, resolving the Lambda execution role credentials automatically.

Key Concept

AWS SDK Default Credential Provider Chain and Lambda Execution Roles
Estimated Time:1m 0s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic