Exams / DVA-C02 / SDKs, retries and error handling / Question 2
DVA-C02 practice question: SDKs, retries and error handling (2 of 2)
Development with AWS Services A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A Node.js application on an Amazon EC2 instance uses the AWS SDK default credential provider chain. The instance has an IAM role that allows dynamodb:PutItem on the table. The application's service file also exports AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for an old IAM user whose permissions were recently removed. PutItem calls now fail with AccessDeniedException. What is the cause?
Choose one answer.
- AA. The SDK uses credentials from environment variables before it tries the instance role.
- BB. The instance role's temporary credentials expired and the SDK cannot refresh them.
- CC. The DynamoDB table needs a resource-based policy that names the instance role.
- DD. The SDK must be told the role ARN in code, because it cannot find roles on its own.
Show the answer and explanation
Answer: A
- A. Right: Correct. Environment variables come early in the default chain, so the old user's keys are found first and the role is never used.
- B. Wrong: The SDK refreshes role credentials from the instance metadata service automatically. Expiry would not cause a lasting AccessDeniedException.
- C. Wrong: The role's identity-based policy is enough within the same account. The role is simply not being used.
- D. Wrong: The default chain finds instance role credentials automatically through the instance metadata service when nothing earlier supplies credentials.
Explanation
The default credential provider chain checks sources in order and stops at the first credentials it finds. Environment variables come before EC2 instance profile credentials, so stale keys in the environment silently override a correctly configured role. Remove the variables and let the SDK fall through to the instance role.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.