Examkin

Soru

Zorluk: OrtaAWS SDKs and Credential Management

A developer is deploying a Go application to Amazon ECS on AWS Fargate. The application needs to retrieve objects from an Amazon S3 bucket. During local testing, the developer initialized the AWS SDK client using static AWS access keys. For the production environment, the application must use the IAM permissions granted by the ECS task role. Which configuration change should the developer make to satisfy these requirements?

  1. A
    Store the static AWS access keys in AWS Systems Manager Parameter Store as SecureString parameters, and configure the application to retrieve and pass these credentials to the SDK constructor at startup.
  2. B
    Assign the required IAM permissions to the ECS task execution role, and update the application code to explicitly call the STS AssumeRole API using the task execution role ARN.
  3. Modify the application code to initialize the SDK client using the default configuration loader without specifying static credentials, and assign the required IAM policy to the ECS task role.Cevap
  4. D
    Embed the AWS access keys directly into the container image's entrypoint script as environment variables, and initialize the SDK client using a static credentials provider.

Cevap

Modify the application code to initialize the SDK client using the default configuration loader without specifying static credentials, and assign the required IAM policy to the ECS task role.
Initializing the AWS SDK client using the default configuration loader without passing static credentials allows the SDK's credentials chain to resolve the credentials automatically. When the application runs within an Amazon ECS container, the SDK detects the ECS container environment variables and queries the local ECS agent for temporary credentials associated with the task's assigned IAM task role. This avoids hardcoding keys and ensures security compliance.

Adım Adım Çözüm

1
Remove the static credentials provider configuration from the Go SDK client initialization code.
The Go SDK is configured to use the default configuration loader (config.LoadDefaultConfig).
This allows the default credentials provider chain to look for credentials in the standard locations, including the ECS container agent.
2
Define an IAM policy with the necessary S3 permissions and attach it to the ECS task role (not the task execution role).
The ECS task has permissions to access the S3 bucket.
The task role provides the application container with temporary credentials containing the required permissions.
3
Deploy the container to AWS Fargate with the task role configured in the task definition.
The ECS container agent injects the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable, which the SDK uses to query for temporary credentials.
The SDK automatically assumes the role and obtains credentials, establishing secure access to S3 without code-level credentials management.

Anahtar Kavram

Using the default SDK credentials chain to automatically resolve temporary credentials via the ECS task role.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS SDKs and Credential Management

Bu konudan daha fazla soru