Examkin

Question

Difficulty: MediumTroubleshooting Local Development and AWS Credentials

A developer is using the AWS Serverless Application Model (AWS SAM) CLI to test an AWS Lambda function locally by running the `sam local invoke` command. The Lambda function, written in Node.js, uses the AWS SDK for JavaScript (v3) to read from an Amazon DynamoDB table in the cloud.

When the developer runs the function locally, the SDK operations fail with an `AccessDeniedException`. The developer has already configured a local AWS CLI profile named `developer-local` in the `~/.aws/credentials` file on the host machine. This profile possesses all necessary permissions to access the DynamoDB table. The developer has also set the environment variable `AWS_PROFILE=developer-local` on the host command line.

Which actions should the developer take to ensure the locally running function has access to the credentials? (Select TWO.)

  1. Invoke the Lambda function locally by passing the profile name using the `--profile developer-local` parameter with the `sam local invoke` command.Answer
  2. Create a JSON file containing the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` from the profile, and pass this file to the command using the `--env-vars` parameter.Answer
  3. C
    Modify the Node.js application code to hardcode the `accessKeyId` and `secretAccessKey` properties in the DynamoDB client configuration using the credentials retrieved from the local profile.
  4. D
    Update the trust relationship policy of the Lambda function's IAM execution role to allow access from the public IP address of the local development environment.
  5. E
    Store the credentials in AWS Systems Manager Parameter Store and update the application code to retrieve them using the AWS Secrets Manager API.

Answer

To resolve the credential issue, the developer can either pass the profile name to the SAM CLI using the `--profile` parameter, or pass the credentials via a JSON file containing environment variables using the `--env-vars` parameter.
When running local Lambda functions with AWS SAM CLI (`sam local invoke`), the runtime environment executes inside a Docker container. This container is isolated and does not inherit host environment variables like `AWS_PROFILE` or host directories like `~/.aws` by default. To supply credentials, the developer can use the `--profile` flag, which instructs SAM CLI to read the specified profile's credentials from the host and mount/pass them to the container. Alternatively, the developer can write the credentials to a JSON file as environment variables and specify it using `--env-vars` to inject those values into the container environment.

Step-by-Step Solution

1
Analyze why the local Lambda execution is failing to find credentials.
Identify that the Lambda function is running inside a Docker container managed by the AWS SAM CLI, which does not automatically inherit the environment variables (like `AWS_PROFILE`) or credentials folder (`~/.aws`) of the host machine.
Container isolation prevents the local runtime from accessing host credentials unless they are explicitly passed or mounted.
2
Evaluate methods to pass the host's AWS CLI credentials into the container environment.
The AWS SAM CLI provides two standard mechanisms: the `--profile` flag to mount and use credentials from a specific host profile, and the `--env-vars` flag to supply environment variables (such as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) from a JSON file.
Using these mechanisms correctly satisfies the SDK's credential provider chain inside the container without compromising security.

Key Concept

AWS SAM local development container credential propagation
Rate this question

Topics

Troubleshooting Local Development and AWS Credentials

More questions from this topic