Examkin

Soru

Zorluk: ZorAWS SDKs and Credential Management

A developer is deploying a Java application to an Amazon ECS cluster running on AWS Fargate. The application uses the AWS SDK for Java to write logs to an Amazon CloudWatch Logs group. The ECS task is configured with an IAM task role that has the necessary permissions to write to CloudWatch. However, the container definition also contains the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, which contain temporary credentials used during a previous CI/CD test run. When the application runs, it fails to write logs and throws an ExpiredTokenException. Which action should the developer take to resolve this issue?

  1. A
    Modify the application code to initialize the CloudWatch Logs client using a StaticCredentialsProvider with access keys passed as constructor arguments.
  2. Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition.Cevap
  3. C
    Update the ECS task role's trust policy to include a Statement block that grants the logs:PutLogEvents action to the task execution role.
  4. D
    Store a new set of active access keys in AWS Systems Manager Parameter Store as a SecureString, and update the application code to retrieve them using the Parameter Store API on startup.

Cevap

Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition.
The correct answer is to remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition. In the AWS SDK default credential provider chain, environment variables have higher precedence than ECS container credentials. If these environment variables are set (even with expired credentials), the SDK will attempt to use them, resulting in an ExpiredTokenException. Removing them allows the SDK chain to fall back to the ECS container credentials provider, which retrieves the credentials associated with the ECS task role.

Adım Adım Çözüm

1
Analyze the AWS SDK default credential provider chain precedence.
The SDK checks environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before it checks the container credentials provider.
Understanding the order of precedence in the SDK is necessary to identify why the expired credentials in the environment variables are being selected over the valid task role.
2
Identify the root cause of the ExpiredTokenException.
The environment variables contain expired temporary credentials, which block the SDK from reaching the container credentials provider.
Since the environment variables are set, the SDK uses them and fails immediately rather than falling back to the task role credentials.
3
Determine the resolution method.
Remove the expired credential environment variables from the container configuration.
By removing these environment variables, the default credential provider chain will successfully fall back to the ECS task role credentials retrieved from the container metadata URI.

Anahtar Kavram

AWS SDK Default Credential Provider Chain Precedence
Bu soruyu puanla

Konular

AWS SDKs and Credential Management

Bu konudan daha fazla soru