Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is troubleshooting an application locally on their workstation. They are running a Node.js application that uses the AWS SDK for JavaScript (v3) to upload objects to an Amazon S3 bucket.

The developer has configured a profile named `staging` in their local `~/.aws/credentials` file:

ini
[staging]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

They also set the following environment variables in their terminal session:

bash
export AWS_PROFILE=staging
export AWS_ACCESS_KEY_ID=AKIAIADSTESTINGEXAMPLE
export AWS_SECRET_ACCESS_KEY=mockKeyStagingExampleKey

When running the application, the developer receives access denied errors because the SDK attempts to authenticate using the `AKIAIADSTESTINGEXAMPLE` credentials (which are invalid) rather than the credentials specified in the `staging` profile.

Which action should the developer take to ensure the SDK uses the `staging` profile credentials?

  1. A
    Set the AWS_SDK_LOAD_CONFIG environment variable to true.
  2. B
    Add aws_profile = staging inside the default section of the ~/.aws/config file.
  3. Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.Answer
  4. D
    Pass the profile name directly to the client constructor by initializing the S3 client as new S3Client({ profile: 'staging' }).

Answer

Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables.
The correct action is to unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables. The AWS SDK default credential provider chain evaluates environment variables for credentials first. If AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set, they are used immediately, ignoring any configured profiles or file-based credentials. By unsetting these variables, the provider chain falls back to using the profile specified in the AWS_PROFILE environment variable, which resolves to the staging credentials.

Step-by-Step Solution

1
Analyze the AWS SDK default credential provider chain resolution order.
Identify that the chain checks environment variables (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY) first, before shared credentials/config files or the AWS_PROFILE variable.
This explains why the invalid credentials in the environment variables are being used instead of the configuration under the 'staging' profile.
2
Determine the necessary change to make the SDK fall back to the credentials file.
Unsetting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables removes them from the top of the provider chain.
Once the explicit credentials variables are cleared, the default chain falls back to looking at the AWS_PROFILE environment variable and the credentials file.

Key Concept

AWS SDK credential provider chain precedence
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic