A developer is testing a Go application locally that reads messages from an Amazon SQS queue. The developer intends to run the application using a specific AWS CLI profile named `dev-profile` defined in the `~/.aws/credentials` file. However, when executing the application in the terminal, the application connects using credentials from a different AWS account. The developer notices that the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are currently set in the active terminal session. Which of the following actions will resolve this issue and force the Go SDK to use the configuration from `dev-profile`?
- AStore the `dev-profile` credentials in the AWS Systems Manager Parameter Store and write code to retrieve them at runtime, as the SDK retrieves configuration values from the Parameter Store before evaluating environment variables.
- Unset the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables in the terminal, and set the `AWS_PROFILE` environment variable to `dev-profile`.Answer
- CUpdate the IAM trust policy of the default profile to trust the `dev-profile` IAM user, allowing the SDK to automatically fall back to the credentials file.
- DHardcode the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` values directly into the Go SDK client initialization block, since the SDK evaluates hardcoded values only after environment variables are cleared.
Answer
Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal, and set the AWS_PROFILE environment variable to dev-profile.
The AWS SDK credential provider chain evaluates environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before checking the shared credentials file. Unsetting the active environment variables and defining AWS_PROFILE forces the SDK to retrieve credentials from the specified profile.
Step-by-Step Solution
Key Concept
AWS SDK Default Credential Provider Chain Precedence