DVA-C03 practice question: SDKs, retries and error handling (2 of 2)
Development with AWS Services A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A reporting service runs on an Amazon EC2 instance and uploads CSV files to an Amazon S3 bucket.
Its S3 client is created without explicit credentials, so the AWS SDK default credential provider chain applies. The instance profile role allows s3:PutObject on the bucket.
A former operator set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the service environment, using an IAM user whose S3 permissions were removed, so uploads now fail with AccessDenied. The application code must not change.
What should the developer do?
Choose one answer.
AA. Remove the two variables from the service environment and restart it, so the SDK falls through to the instance role.
BB. Add a bucket policy statement that grants PutObject to the former IAM user, so that uploads made with its stale keys succeed.
CC. Attach a policy to the instance role that denies PutObject to the environment keys, so that the SDK skips them for uploads.
DD. Pass the instance role's ARN to the S3 client constructor in code, so that the SDK assumes the role directly for each request.
Show the answer and explanation
Answer: A
A. Right: Correct. Environment variables are checked before the instance profile in the default chain. Once they are removed, the SDK finds and uses the role's temporary credentials. Learn more: Set credentials in Node.js (opens in a new tab)
B. Wrong: This adds permissions to a user whose key should not be used at all. The stale key would still take precedence over the instance role.
C. Wrong: IAM policies control what a principal may do, not which credentials the SDK selects. The environment keys would still be used, and their requests would still fail.
D. Wrong: The code must not change, and the default chain already finds the instance profile's role without any role ARN. Extra configuration is not needed.
Explanation
The default chain stops at the first credentials it finds, and environment variables come before the instance profile. The stale user keys therefore win, and the role is never used. Removing the variables lets the chain reach the role without any code change.
Want more on SDKs, retries and error handling? The 5 full-length practice sets have 10 more SDKs, retries and error handling questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →