Examkin

Question

Difficulty: HardTroubleshooting Local Development and AWS Credentials

A developer is troubleshooting a Node.js application running on a local development workstation. The application uses the AWS SDK for JavaScript v3 to write data to an Amazon DynamoDB table. The developer's local environment contains multiple AWS CLI profiles configured in ~/.aws/credentials.

The developer sets the environment variable AWS_PROFILE=dev-profile in the terminal and runs the application. However, the application fails to write to the development database and instead attempts to write to the production database, resulting in access denied errors. Further investigation reveals that the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are currently set in the active terminal session and correspond to production credentials.

Which two actions will resolve this issue by ensuring the application uses the dev-profile credentials? (Choose two.)

  1. Run the command to unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the active terminal session.Answer
  2. Modify the application code to initialize the DynamoDB client using the fromIni credential provider from the @aws-sdk/credential-providers package, explicitly specifying the dev-profile profile.Answer
  3. C
    Hardcode the dev-profile access key and secret key directly into the credentials configuration property of the DynamoDB client constructor.
  4. D
    Update the trust policy of the production IAM user associated with the active terminal environment variables to permit cross-account delegation to the development IAM user.
  5. E
    Store the dev-profile credentials in AWS Systems Manager Parameter Store as secure strings and configure the SDK to read from it before environment variables.

Answer

To resolve this issue, the developer should unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the active terminal session, or modify the application code to initialize the client using the fromIni credential provider targeting the dev-profile profile.
The default credential provider chain resolves environment variables first. Therefore, unsetting the active production environment variables forces the SDK to evaluate the next step in the chain, resolving the profile specified in the AWS_PROFILE environment variable. Alternatively, explicitly configuring the client in the code using the fromIni provider overrides the default chain sequence entirely, forcing the SDK to retrieve credentials from the specified local profile.

Step-by-Step Solution

1
Analyze the client-side credential resolution order of the AWS SDK default credential provider chain.
Confirm that environment variables (like AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) have the highest precedence, overriding profile-based settings.
This explains why the SDK ignores the AWS_PROFILE environment variable as long as the production keys are active in the terminal.
2
Determine the environment-level remediation step.
Unsetting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY variables allows the chain to evaluate the next provider, which retrieves profile settings.
Unsetting environment variables forces the SDK to fall back to the shared credential file using the profile specified in AWS_PROFILE.
3
Determine the application code-level remediation step.
Using the fromIni provider explicitly loads the credentials from the dev-profile in the shared credentials file.
This bypasses the default chain precedence rules entirely, ensuring the application executes under the correct credentials regardless of terminal state.

Key Concept

AWS SDK credential resolution precedence and configuration overrides
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic