Examkin

Soru

Zorluk: OrtaAWS SDKs and Credential Management

A developer is writing an on-premises Python application that uses the AWS SDK (Boto3) to retrieve objects from an Amazon S3 bucket located in a separate, secondary AWS account. The developer has configured the on-premises server with an IAM user's long-term access keys stored in the default profile of the local credentials file. The security team has created an IAM role in the secondary account named CrossAccountS3ReadRole that has the required permission to access the bucket. How should the developer configure the AWS SDK to retrieve the S3 objects using the permissions of the secondary account's IAM role?

  1. Configure a new profile in the AWS config file containing the target role's ARN and the source profile, and then initialize the SDK session using this profile name.Cevap
  2. B
    Hardcode the temporary access keys, secret keys, and session tokens returned by a manual AWS CLI STS assume-role command directly in the application's initialization code.
  3. C
    Configure the IAM user's trust policy in the local credentials file to trust the secondary account's S3 bucket, and initialize the S3 client using the default credentials provider.
  4. D
    Store the IAM role's ARN in AWS Secrets Manager and configure the SDK's default credentials provider to automatically query Secrets Manager to assume the role.

Cevap

Configure a new profile in the AWS config file containing the target role's ARN and the source profile, and then initialize the SDK session using this profile name.
Configuring a named profile in the AWS configuration file using 'role_arn' and 'source_profile' is the recommended way to handle role assumption in the AWS SDK. The SDK handles the API call to AWS STS (AssumeRole) using the credentials from the source profile and automatically manages the lifecycle and refresh of the temporary credentials.

Adım Adım Çözüm

1
Define a named profile in the AWS configuration file (~/.aws/config) specifying the parameters for role assumption.
The profile is configured with the role_arn of the secondary account role and the source_profile set to 'default'.
This establishes the relationship between the target role to assume and the local credentials that have permission to assume it.
2
Initialize the Boto3 session in the Python code by passing the new profile name to the session constructor.
The session is initialized using the temporary credentials obtained from assuming the target role.
By passing the profile name, the SDK's default credential provider chain delegates the authentication to the STS assume-role provider, which handles token generation and automatic refreshes transparently.

Anahtar Kavram

AWS SDK Profile-based IAM Role Assumption
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS SDKs and Credential Management

Bu konudan daha fazla soru