Examkin

Soru

Zorluk: OrtaAWS SDKs and Credential Management

A developer is troubleshooting an application that uses the AWS SDK to access Amazon S3. The application is running on an Amazon EC2 instance that has an IAM instance profile attached. However, the developer notices that the application is using outdated, static credentials instead of the temporary credentials provided by the instance profile. Which of the following could be the root causes of this behavior? (Select TWO.)

  1. AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are defined in the operating system environment of the EC2 instance.Cevap
  2. A shared credentials file located at ~/.aws/credentials contains a [default] profile with static credentials.Cevap
  3. C
    The trust policy of the IAM role associated with the instance profile does not explicitly list the private IP address of the EC2 instance.
  4. D
    The SDK's default credential provider chain is configured to query the EC2 Instance Metadata Service (IMDS) before checking local environment variables.
  5. E
    The application code is missing the required SDK configuration to automatically retrieve credentials from AWS Systems Manager Parameter Store.

Cevap

The application could be using static credentials because environment variables are defined on the EC2 instance, or because a shared credentials file with a default profile is present. Both of these sources take precedence over the EC2 instance profile in the AWS SDK default credential provider chain.
The AWS SDK default credential provider chain resolves credentials in a specific order of precedence. Environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and the shared credentials file (such as the default profile in ~/.aws/credentials) are both evaluated before the Amazon EC2 Instance Metadata Service (IMDS). If either of these sources contains static credentials, the SDK will use them instead of the temporary credentials provided by the EC2 instance profile.

Adım Adım Çözüm

1
Analyze the AWS SDK default credential provider chain order of precedence.
The chain evaluates credentials in the following order: 1. Environment variables, 2. Shared credentials file, 3. ECS task role credentials (if applicable), 4. EC2 instance profile credentials (via IMDS).
To determine which credential sources take precedence over the EC2 instance profile.
2
Evaluate the scenario where the application uses static credentials instead of the instance profile credentials.
Any credential source higher in the chain containing static credentials will prevent the SDK from querying the EC2 instance profile.
To identify potential sources of static credentials that override the instance profile.
3
Identify the correct options based on the chain evaluation.
Environment variables and the shared credentials file default profile both reside higher in the chain than instance profile credentials, making them the correct root causes.
To choose the two options that explain the observed behavior.

Anahtar Kavram

AWS SDK Default Credential Provider Chain Order of Precedence
Bu soruyu puanla

Konular

AWS SDKs and Credential Management

Bu konudan daha fazla soru