A city permitting portal runs on Elastic Beanstalk and must call DynamoDB from the app without hard-coding AWS keys. How should the SDK authenticate?
Select an answer to reveal the explanation.
Short Explanation
Beanstalk already straps an instance profile onto the EC2 hosts like a city badge on a desk clerk. Let the SDK’s default credential chain grab those temporary role credentials—no keys taped to the monitor. Hard-coded keys and anonymous DynamoDB calls are the wrong doors.
Full Explanation
Applications on Elastic Beanstalk should authenticate to AWS APIs through the instance profile attached to the environment’s EC2 instances. The AWS SDKs resolve credentials via the default provider chain, which includes that role’s temporary credentials. Long-term access keys in environment properties increase leak risk. DynamoDB does not accept anonymous writes for application data, and IAM user passwords are not used to sign AWS API requests.