Examkin

Question

Difficulty: MediumAWS SDKs and Credential Management

A developer is running a containerized Python application in Amazon ECS on AWS Fargate. The container needs to read messages from an Amazon SQS queue. The ECS Task Definition has an ECS Task Role assigned with the necessary SQS permissions. During deployment, the developer accidentally leaves the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY set to developer-specific credentials that do not have permission to access SQS. When the application initializes the Boto3 client, which of the following describes the credential resolution behavior and the result of the API calls?

  1. The application uses the credentials defined in the environment variables because environment variables take precedence over ECS container credentials in the default credential provider chain, causing the SQS API calls to fail.Answer
  2. B
    The application uses the ECS Task Role credentials because Fargate task runtimes override environment variable credentials to ensure security, resulting in successful SQS API calls.
  3. C
    The application fails to initialize the SQS client because the SDK detects a conflict between the environment variables and the ECS task role credentials, raising a configuration exception.
  4. D
    The application uses the ECS Task Execution Role credentials instead of the Task Role, causing the SQS API calls to fail because the Task Execution Role is only used for container pull and logging permissions.

Answer

The application uses the credentials defined in the environment variables because environment variables take precedence over ECS container credentials in the default credential provider chain, causing the SQS API calls to fail.
The default credential provider chain checks for credentials in a specific order: first environment variables, then system properties (if applicable), then web identity token credentials, then shared credentials profiles, and finally ECS container credentials (Task Roles) and EC2 instance metadata. Because environment variables are checked first, any set environment variables will override the Task Role credentials, causing the application to use the unauthorized credentials and fail.

Step-by-Step Solution

1
Analyze the execution environment and configured credential sources.
The application has two credential sources available: environment variables (developer keys) and ECS container credentials (ECS Task Role).
To determine which credentials the SDK uses, we must identify all present credentials.
2
Evaluate the order of precedence in the AWS SDK Default Credential Provider Chain.
Environment variables are evaluated first, while ECS container credentials are evaluated later in the chain.
The SDK uses the first available credentials in the default chain order.
3
Determine the outcome of the API calls based on the resolved credentials.
The application uses the developer-specific credentials from the environment variables, which lack SQS permissions, leading to an Access Denied error.
Since the environment variable credentials take precedence, they are used, and their lack of permissions causes the API calls to fail.

Key Concept

AWS SDK Default Credential Provider Chain precedence
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic