Examkin

Soru

Zorluk: OrtaAWS SDKs and Credential Management

A developer is writing a Node.js application that uses the AWS SDK for JavaScript to read data from an Amazon DynamoDB table. The application must run on the developer's local workstation during development and on an AWS Lambda function in the production environment. Which two configurations should the developer use to manage credentials securely and ensure the application works in both environments without code modifications?

  1. A
    Initialize the DynamoDB client by passing the AWS access key and secret key directly to the constructor in the application code.
  2. Configure the credentials in the shared credentials file (~/.aws/credentials) on the local workstation, and assign an IAM execution role with DynamoDB access permissions to the Lambda function.Cevap
  3. Instantiate the DynamoDB client using the default constructor without passing explicit credentials.Cevap
  4. D
    Package a local configuration file containing the developer's AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY directly inside the Lambda deployment package.
  5. E
    Store the developer's long-lived IAM access keys in AWS Secrets Manager, and configure the application to query Secrets Manager at startup to retrieve credentials.

Cevap

Configure credentials in the shared credentials file (~/.aws/credentials) on the local workstation, assign an IAM execution role with DynamoDB access permissions to the Lambda function, and instantiate the DynamoDB client using the default constructor without passing explicit credentials.
The correct approach involves configuring the developer's credentials locally in the shared credentials file, assigning an IAM execution role to the Lambda function, and instantiating the SDK client using the default constructor. When initialized without credentials, the AWS SDK default credential provider chain looks for credentials dynamically. On the local workstation, the SDK resolves credentials from the shared credentials file. On Lambda, the SDK automatically retrieves temporary security credentials from the IAM execution role via environment variables.

Adım Adım Çözüm

1
Determine the mechanism the AWS SDK uses to locate credentials automatically.
The AWS SDK implements the default credential provider chain, which searches for credentials in a specific sequence: environment variables, system properties, the shared credentials file, and container/execution roles.
Leveraging this chain allows writing environment-agnostic code.
2
Set up credential sources for local and production execution environments.
Locally, the developer saves keys to the shared credentials file (~/.aws/credentials). In AWS Lambda, the developer assigns an IAM execution role with the required DynamoDB permissions.
This separates local access credentials from production environment configuration, using temporary security tokens automatically managed by Lambda.
3
Code the initialization of the SDK client to use the credential provider chain.
Call the client constructor without arguments or parameters, letting the chain handle lookup.
This avoids hardcoding or packaging secrets and ensures seamless local and cloud execution without changing the code.

Anahtar Kavram

AWS SDK Default Credential Provider Chain
Bu soruyu puanla

Konular

AWS SDKs and Credential Management

Bu konudan daha fazla soru