Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

An organization is designing a microservice that will run on AWS Lambda within a private subnet to process messages. The microservice uses the AWS SDK to retrieve sensitive configuration data. During local testing on developer workstations, the application needs to use credentials from a local AWS CLI profile named `dev-profile`. When running on AWS, the microservice must run securely with minimal privilege and without hardcoded secrets.

Which two configuration steps should the developer perform to satisfy these requirements? (Select TWO.)

  1. Set the AWS_PROFILE environment variable to dev-profile on the developers' local workstations.Answer
  2. Assign an IAM execution role with the required permissions to the Lambda function.Answer
  3. C
    Initialize the AWS SDK clients by passing the AWS Access Key ID and Secret Access Key retrieved from the developer profile directly in the constructor.
  4. D
    Configure the Lambda function's resource policy to trust the developer IAM user to allow access to AWS services.
  5. E
    Deploy a NAT Gateway in the private subnet where the Lambda function resides to allow it to retrieve secrets from AWS Secrets Manager.

Answer

To satisfy the requirements, the developer should set the AWS_PROFILE environment variable to the named developer profile on local workstations, and assign an IAM execution role with the necessary permissions to the AWS Lambda function in the production environment.
The correct actions involve setting the environment variable to specify the local named profile and assigning an IAM execution role to the Lambda function. The default credential provider chain of the AWS SDK handles both scenarios seamlessly: locally it resolves the profile via the environment variable, and in Lambda it retrieves the temporary credentials from the execution role.

Step-by-Step Solution

1
Identify how the AWS SDK locates credentials locally.
Setting the AWS_PROFILE environment variable directs the SDK default credential provider chain to retrieve credentials from the shared credentials file for the specified profile.
This avoids hardcoding credentials or modifying code between environments.
2
Determine how the AWS SDK retrieves credentials in the AWS Lambda environment.
The SDK default credential provider chain automatically queries the Lambda execution environment to obtain temporary credentials from the assigned IAM execution role.
This conforms to the principle of least privilege and uses AWS managed temporary credentials.
3
Evaluate the security and routing requirements of the private subnet.
Deploying a NAT Gateway in a private subnet is incorrect; NAT Gateways must be in a public subnet. Additionally, accessing Secrets Manager from a private VPC can be done via VPC endpoints or a public NAT Gateway.
Correct network topology is required to allow the Lambda function to make outbound connections.

Key Concept

AWS SDK Default Credential Provider Chain
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic