Examkin

Question

Difficulty: HardData Store Operations with Amazon DynamoDB

A developer is implementing a transaction processing service for a financial ledger application. The application tracks transactions in an Amazon DynamoDB table with the following schema:
- Partition Key: `AccountIdAccountId` (string)
- Sort Key: `TransactionIdTransactionId` (string)
- Attributes: `AmountAmount` (number), `TransactionTimestampTransactionTimestamp` (number), `StatusStatus` (string)

The application currently retrieves all transactions for a given `AccountIdAccountId` that are in a 'PENDING' status. During peak traffic, the application experiences high latency and receives `ProvisionedThroughputExceededException` errors, even though the total Read Capacity Units (RCUs) provisioned are sufficient for the workload. Furthermore, during a security audit, it was discovered that the ECS tasks running this microservice are configured with hardcoded AWS credentials in the container environment variables.

Which two actions should the developer take to resolve the latency, throughput, and security issues?

  1. Create a Local Secondary Index (LSI) with `StatusStatus` as the sort key, and execute a `Query` operation specifying the `AccountIdAccountId` and the `StatusStatus` key condition.Answer
  2. B
    Use a `Scan` operation with a `FilterExpression` on the base table to retrieve items matching the `AccountIdAccountId` and a `StatusStatus` of 'PENDING'.
  3. Associate an IAM policy granting DynamoDB access to the ECS Task Role by specifying the `taskRoleArn` in the task definition, and configure the SDK client to retrieve credentials automatically.Answer
  4. D
    Hardcode the AWS access key and secret key in the application's SDK client initialization code to bypass role resolution latency.
  5. E
    Attach the DynamoDB access policy to the ECS Task Execution Role using the `executionRoleArn` property to grant the running container permission to perform data plane operations.

Answer

Create a Local Secondary Index (LSI) with `StatusStatus` as the sort key, and execute a `Query` operation specifying the `AccountIdAccountId` and the `StatusStatus` key condition, and associate an IAM policy granting DynamoDB access to the ECS Task Role by specifying the `taskRoleArn` in the task definition, configuring the SDK client to retrieve credentials automatically.
The correct combination of actions optimizes performance and meets security guidelines. Creating a Local Secondary Index (LSI) with `StatusStatus` as the sort key permits using the `Query` operation to retrieve only pending items for a given partition key, preventing high RCU consumption. Using the ECS Task Role (`taskRoleArn`) is the standard secure pattern to grant credentials to containers at runtime, avoiding hardcoding.

Step-by-Step Solution

1
Analyze the table schema and query pattern to address RCU usage and latency.
The current query filters by `StatusStatus` on a table partitioned by `AccountIdAccountId`. Without an index on `StatusStatus`, the developer must either scan the table or query all items for a partition and filter them. Creating a Local Secondary Index (LSI) with `StatusStatus` as the sort key allows a direct query on both attributes.
LSIs are efficient for querying attributes other than the base table's sort key for a single partition key value.
2
Select the correct API call to perform the query.
The developer should use the `Query` API on the LSI instead of a `Scan` on the base table.
Using `Query` restricts the search to a specific partition key and sort key range, while `Scan` inspects all items in the table/index, wasting RCUs.
3
Address the security finding regarding hardcoded container credentials.
The hardcoded credentials must be removed, and the ECS Task Definition must define the `taskRoleArn` with an IAM role containing DynamoDB access permissions.
The Task Role gives the application containers permissions to call AWS APIs, whereas the Task Execution Role only provides the container agent permissions to pull images and stream logs.

Key Concept

Optimizing DynamoDB queries using Local Secondary Indexes (LSIs) and securing containerized applications using ECS Task Roles.
Rate this question

Topics

Data Store Operations with Amazon DynamoDB

More questions from this topic