Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A backend application running on Amazon EC2 instances must access an Amazon DynamoDB table using the AWS SDK. The developer needs to configure the application to retrieve temporary credentials automatically without using any long-lived credentials. Which configuration should the developer implement?

  1. A
    Store the access key and secret access key of an IAM user in AWS Secrets Manager, and configure the application to retrieve them at startup to initialize the SDK client.
  2. B
    Query the Instance Metadata Service (IMDS) endpoint directly from the application code to retrieve temporary credentials, and pass them explicitly to the SDK client constructor.
  3. Attach an IAM role with DynamoDB permissions to the EC2 instance profile, and construct the SDK client using the default constructor without passing explicit credentials.Answer
  4. D
    Create an IAM execution role, assign its ARN to the AWS_ROLE_ARN environment variable, and write application code that uses the AWS Security Token Service (STS) to assume the role at startup.

Answer

Attaching an IAM role with DynamoDB permissions to the EC2 instance profile, and constructing the SDK client using the default constructor without passing explicit credentials.
Attaching an IAM role to the EC2 instance profile is the recommended best practice. The AWS SDK's default credential provider chain automatically looks for credentials provided by the EC2 Instance Metadata Service (IMDS) when no credentials are explicitly configured in the code. This completely removes the need for long-lived credentials and manages the rotation of temporary credentials automatically.

Step-by-Step Solution

1
Create an IAM role with a policy allowing the required DynamoDB operations and attach it to an EC2 instance profile.
An IAM role is created that can be assumed by EC2 instances to generate temporary security credentials.
This establishes authorization policies without creating long-lived IAM user keys.
2
Associate the instance profile with the EC2 instances hosting the application.
The application running on the instances can access the EC2 Instance Metadata Service (IMDS) to fetch temporary credentials.
This makes the temporary credentials securely accessible to the runtime environment.
3
Initialize the AWS SDK client in the application code using the default constructor without passing explicit access keys.
The AWS SDK automatically invokes the default credential provider chain, which searches for credentials starting from environment variables down to the instance metadata service.
Using the default credentials chain avoids hardcoding credentials and guarantees automated retrieval and rotation.

Key Concept

AWS SDK Default Credential Provider Chain and EC2 Instance Profiles
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic