Examkin

Soru

Zorluk: Çok zorAWS SDKs and Credential Management

A developer is deploying a Go-based daemon to an on-premises server. The daemon must interact with Amazon DynamoDB and AWS Secrets Manager. To comply with strict security policies, no long-term AWS credentials can be stored on the server's local disk. The enterprise has an existing internal authentication service running at `http://internal-auth.local` that generates temporary AWS credentials upon successful authentication. Which two actions should the developer take to configure the AWS SDK in the Go application to automatically retrieve and use these credentials?

  1. Configure a profile in the shared AWS config file on the server, specifying the credential_process parameter pointing to a script that queries the internal service and outputs the credentials in the required JSON format.Cevap
  2. B
    Set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables on the server to the URL of the internal authentication service.
  3. C
    Define a custom IAM trust policy for the target IAM role that allows the public IP address of the on-premises server to assume the role without providing credentials.
  4. Set the AWS_PROFILE environment variable on the server to the name of the profile containing the credential_process configuration.Cevap
  5. E
    Initialize the SDK client in the Go application code by setting the CredentialProviderEndpoint parameter to point to the URL of the internal authentication service.

Cevap

Configure a profile in the shared AWS config file on the server, specifying the credential_process parameter pointing to a script that queries the internal service and outputs the credentials in the required JSON format, and set the AWS_PROFILE environment variable on the server to the name of the profile containing the credential_process configuration.
The correct combination of steps involves configuring the credential_process parameter in the shared AWS config file and setting the AWS_PROFILE environment variable. The credential_process config option allows the AWS SDK to execute an external tool or script, retrieve temporary AWS credentials in a standard JSON format, and automatically handle credential caching and expiration. Setting the AWS_PROFILE environment variable points the SDK to the custom profile that specifies the external process configuration.

Adım Adım Çözüm

1
Identify the constraints and requirements for the on-premises credentials flow.
Static keys cannot be saved to the local disk, meaning temporary credentials must be retrieved dynamically from the internal service.
Security compliance forbids long-term keys on local storage.
2
Implement the credential_process configuration.
A profile is defined in the shared AWS config file (~/.aws/config) specifying the credential_process configuration pointing to a wrapper script that performs authentication against the internal API and prints the standard credential JSON.
The AWS SDK automatically executes this process to retrieve, parse, and refresh temporary access credentials.
3
Configure the environment variables to activate the custom profile.
The AWS_PROFILE environment variable is set to the name of the newly configured profile.
This directs the AWS SDK default credential provider chain to prioritize that specific profile configuration.

Anahtar Kavram

AWS SDK Credential Resolution via External Process
Bu soruyu puanla

Konular

AWS SDKs and Credential Management

Bu konudan daha fazla soru