Examkin

Question

Difficulty: Very hardAWS SDKs and Credential Management

An application deployed on an Amazon EC2 instance uses the AWS SDK to perform read and write operations on an Amazon DynamoDB table. An IAM instance profile named `DynamoDB-Write-Role` is attached to the EC2 instance. However, the developer has also configured a shared credentials file under `/home/ec2-user/.aws/credentials` that contains a default profile with static credentials that only allow read-only access to DynamoDB. The environment variable `AWS_PROFILE` is not set. During application execution, all write operations to DynamoDB fail with an `AccessDeniedException`. Which of the following describes the root cause of this failure and the correct resolution?

  1. A
    The SDK attempts to use the EC2 instance profile credentials first, but defaults to the shared credentials file because the application is running under the default `ec2-user` system account. The developer must run the application under a different system account that does not have a `.aws` directory.
  2. B
    The SDK evaluates the EC2 instance profile first, but falls back to the shared credentials file because the instance profile credentials do not have a matching session token. The developer must restart the EC2 instance to force IMDS credential regeneration.
  3. The SDK resolves credentials from the shared credentials file first because it precedes the EC2 instance profile in the default credential provider chain. The developer must remove the static credentials from the shared credentials file to allow the chain to fall back to the instance profile.Answer
  4. D
    The SDK merges the permissions from the shared credentials file and the EC2 instance profile, and defaults to the most restrictive permission set. The developer must modify the IAM trust policy of the instance profile to allow the default profile to assume it.

Answer

The SDK resolves credentials from the shared credentials file first because it precedes the EC2 instance profile in the default credential provider chain. The developer must remove the static credentials from the shared credentials file to allow the chain to fall back to the instance profile.
The default credential provider chain evaluates the shared credentials file (`~/.aws/credentials`) before checking for EC2 instance profile credentials. Because a default profile exists in the shared credentials file, the chain successfully resolves credentials from that source and stops its search. It does not fall back to subsequent credentials in the chain when an authorization failure (such as `AccessDeniedException`) occurs. Removing the static credentials from the shared credentials file allows the provider chain to reach the EC2 instance profile evaluation step.

Step-by-Step Solution

1
Analyze the location of the credentials configured in the environment.
The environment has an IAM instance profile attached and a default profile in the shared credentials file at `/home/ec2-user/.aws/credentials`.
To determine which credential sources are available to the application.
2
Evaluate the order of precedence in the AWS SDK default credential provider chain.
The shared credentials file is checked and resolved before the EC2 instance profile (IMDS).
To identify which credential source the SDK will select to sign the requests.
3
Determine the behavior of the SDK when the resolved credentials lack required permissions.
The SDK attempts the API call using the resolved read-only credentials, which fails with an `AccessDeniedException`. The SDK does not fall back to the next provider in the chain.
To explain why the write operation failed despite the instance profile having the correct permissions.
4
Identify the resolution to allow the application to use the instance profile.
Remove the static credentials from the shared credentials file, allowing the default chain to fall back to the EC2 instance profile.
To enable the SDK to successfully resolve the credentials from the EC2 instance profile.

Key Concept

AWS SDK Default Credential Provider Chain Order of Precedence
Estimated Time:3m 0s
Rate this question

Topics

AWS SDKs and Credential Management

More questions from this topic