Examkin

Question

Difficulty: HardTroubleshooting Local Development and AWS Credentials

A developer is using Docker Compose to locally test a Python application that uses the AWS SDK (Boto3) to retrieve secrets from AWS Secrets Manager. The application runs inside the container under a non-root user account named `appuser` (with home directory `/home/appuser`).

On the host workstation, the developer has configured the AWS CLI with a profile named `local-dev` that contains the necessary IAM permissions. The container fails to authenticate with AWS, raising a `ClientError` indicating that no credentials can be found. The current `docker-compose.yml` file contains the following volume mount:

yaml
volumes:
- ~/.aws:/root/.aws:ro

Which two actions must the developer take to resolve this issue and ensure Boto3 uses the correct credentials? (Select two.)

  1. Update the volume mount in the `docker-compose.yml` file to map the host's `~/.aws` directory to `/home/appuser/.aws:ro`.Answer
  2. Add the `AWS_PROFILE=local-dev` environment variable to the container's service environment block in the `docker-compose.yml` file.Answer
  3. C
    Set the `AWS_PROFILE` environment variable to `local-dev` on the host workstation's shell before running `docker-compose up`.
  4. D
    Set the `AWS_SDK_LOAD_CONFIG=true` environment variable in the container and mount the credentials file to `/etc/aws/credentials:ro`.
  5. E
    Configure the AWS Secrets Manager resource policy to allow access from the container's local IP address using a `StringEquals` condition.

Answer

Update the volume mount to target `/home/appuser/.aws:ro` and set the `AWS_PROFILE` environment variable to `local-dev` in the docker-compose file.
The correct actions are to update the volume mount to target `/home/appuser/.aws:ro` and to add the `AWS_PROFILE=local-dev` environment variable in the docker-compose file. Since the application runs under the `appuser` context, Boto3 searches `/home/appuser/.aws` for credentials. Additionally, `AWS_PROFILE` must be set in the container environment so the SDK knows to select the `local-dev` profile rather than falling back to `default`.

Step-by-Step Solution

1
Determine the executing user context within the container.
The application runs as `appuser`, which means Boto3 will look for config/credentials in `/home/appuser/.aws` instead of `/root/.aws`.
SDKs resolve credentials relative to the home directory of the current user executing the process.
2
Adjust the volume mounting path to match the user's home directory.
Map the host's `~/.aws` directory to `/home/appuser/.aws` inside the container.
This makes the host's AWS profiles accessible to Boto3 running under the `appuser` account.
3
Ensure the container processes use the correct profile.
Define the `AWS_PROFILE` environment variable as `local-dev` in the container's environment definition.
By default, the SDK looks for the `default` profile. Defining the profile name via `AWS_PROFILE` forces the SDK to load the `local-dev` configuration.

Key Concept

Credential resolution in containerized environments relies on correct volume mounting to the active user's home directory and explicit passing of environment variables like AWS_PROFILE.
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic