Examkin

Soru

Zorluk: ZorAWS SDKs and Credential Management

A developer is deploying a containerized Python application to Amazon ECS on AWS Fargate. The application needs to access an Amazon S3 bucket. During local development, the developer configured the AWS SDK (Boto3) by setting the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables in the local shell. In the ECS task definition, the developer assigned an IAM role with the correct permissions to the `taskRoleArn` parameter. However, when the container runs in Fargate, the application receives authorization errors because it tries to use the developer's local credentials, which have expired.

Which of the following actions should the developer take to resolve this issue and ensure the application securely accesses Amazon S3? (Select TWO.)

  1. Remove the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables from the task definition's container environment configuration.Cevap
  2. Configure the IAM role's trust policy to allow the `ecs-tasks.amazonaws.com` service principal to perform the `sts:AssumeRole` action.Cevap
  3. C
    Add the required Amazon S3 read permissions to the ECS Task Execution Role (`executionRoleArn`) instead of the Task Role.
  4. D
    Include a shared credentials file containing static credentials in the container image at the `~/.aws/credentials` path.
  5. E
    Update the container code to manually fetch temporary credentials from the EC2 Instance Metadata Service (IMDSv2) endpoint.

Cevap

To resolve the credential resolution issue, the developer must remove the static environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) from the task definition's container environment configuration, and configure the IAM role's trust policy to allow the ecs-tasks.amazonaws.com service principal to assume the role.
Removing the environment variables from the task definition is correct because the AWS SDK Default Credential Provider Chain checks environment variables first. Removing them allows the chain to evaluate downstream providers, specifically the container credentials provider. Configuring the trust policy for ecs-tasks.amazonaws.com is correct because it authorizes the ECS service to assume the Task Role and provide temporary credentials to the application.

Adım Adım Çözüm

1
Analyze the credential lookup hierarchy of the AWS SDK.
The AWS SDK credential provider chain checks environment variables before container credentials. The presence of expired environment variables prevents the SDK from falling back to the task role credentials.
To resolve the order of precedence issue, the incorrect environment variables must be removed.
2
Configure trust relationship for ECS IAM roles.
The IAM role assigned to the task must trust the ECS tasks service principal.
This permits AWS ECS to call STS AssumeRole to assume the IAM role and supply credentials to the container.

Anahtar Kavram

Understanding the AWS SDK Default Credential Provider Chain precedence and ECS Task Role requirements.
Bu soruyu puanla

Konular

AWS SDKs and Credential Management

Bu konudan daha fazla soru