A developer is testing a Go microservice locally. The microservice uses the AWS SDK for Go v2 to retrieve parameter configurations from Amazon Systems Manager (SSM) Parameter Store using the following initialization code:
go
// WARNING: Do not hardcode credentials in production.
// This code relies on the default credential provider chain.
cfg, err := config.LoadDefaultConfig(context.TODO())
if err != nil {
log.Fatalf("unable to load SDK config, %v", err)
}
client := ssm.NewFromConfig(cfg)
The application runs inside a local Docker container as a non-root user `appuser` (home directory `/home/appuser`). To supply AWS credentials to the container, the developer ran the container with the environment variable `AWS_PROFILE=dev-profile` and mounted the host's `~/.aws/credentials` file to `/home/appuser/.aws/credentials`.
On the host machine, the AWS CLI configurations are:
`~/.aws/config`:
ini
[profile dev-profile]
role_arn = arn:aws:iam::123456789012:role/DevDeveloperRole
source_profile = base-profile
`~/.aws/credentials` (using placeholder credentials for security):
ini
[base-profile]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
When the application runs in the container, it fails with the error `operation error SSM: GetParameter, failed to resolve credentials`. However, running `aws ssm get-parameter --name /app/config --profile dev-profile` directly on the host machine succeeds.
Which of the following is the root cause of this credential resolution failure?
- AThe AWS SDK for Go v2 default credential chain does not support containerized environments, requiring the developer to pass the raw credentials directly into the `config.LoadDefaultConfig` function parameters in the application code.
- BThe IAM role trust policy for `DevDeveloperRole` does not authorize the service principal `ecs-tasks.amazonaws.com` to assume the role, causing the STS assume-role operation to fail when initiated from the container environment.
- The `dev-profile` profile relies on a role assumption chain defined in the host's `~/.aws/config` file, which was not mounted into the container, preventing the SDK from locating the profile configuration.Cevap
- DThe Go SDK requires the application to retrieve credentials from AWS Systems Manager Parameter Store or AWS Secrets Manager rather than reading profile configurations from the local filesystem.