DVA-C02 Security Practice Question
Exhibit
Error: Unable to locate credentials. You can configure credentials by running "aws configure".
Refer to the exhibit. A developer runs an AWS CLI command on an EC2 instance and receives the error shown. The instance has an IAM role attached with the necessary permissions. What is the most likely cause of this error?
⚠ Common exam trap
A common mix-up: candidates assume the IAM role is automatically used by the CLI, but they overlook that environment variables or a local AWS credentials file can override the instance profile credentials, causing a 'Unable to locate credentials' error even when the role is correctly attached.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CLI is not configured to use the instance profile credentials; environment variables or config file might be overriding.
The error indicates that the AWS CLI cannot find credentials. Even though the EC2 instance has an IAM role attached, the CLI will not automatically use instance profile credentials if environment variables (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or a config file (e.g., ~/.aws/credentials) are present with different or invalid values. The CLI's credential provider chain checks environment variables first, then the config file, and only falls back to the instance metadata service (IMDS) if no other credentials are found. Therefore, overriding settings are the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CLI command is not supported on EC2 instances.
Why it's wrong here
The AWS CLI is fully supported and commonly used on EC2 instances to interact with AWS services. EC2 instances are a primary environment for running automated scripts and applications that require programmatic access to AWS, making the CLI an essential tool in such scenarios. Therefore, stating that the CLI command is not supported on EC2 instances is fundamentally incorrect, as it contradicts standard AWS operational practices.
- ✓
The CLI is not configured to use the instance profile credentials; environment variables or config file might be overriding.
Why this is correct
This option correctly identifies a common troubleshooting scenario. The AWS CLI follows a specific credential resolution order, where environment variables (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) and entries in the ~/.aws/credentials file take precedence over instance profile credentials. If explicit, but invalid or incomplete, credentials are set in these higher-priority locations, the CLI will attempt to use them first and fail with a "missing credentials" error, even if a valid instance profile is attached to the EC2 instance.
- ✗
The IAM role does not have the required permissions for the CLI command.
Why it's wrong here
A "missing credentials" error specifically indicates that the AWS CLI could not locate any valid authentication information to send with its request to AWS. This is distinct from a permissions error, which would occur if the CLI successfully authenticated with valid credentials but the associated IAM identity lacked the necessary permissions for the requested action. The error message clearly points to an authentication failure, not an authorization issue.
- ✗
The instance does not have an IAM role attached.
Why it's wrong here
The question stem explicitly states that an IAM role is attached to the EC2 instance. Therefore, this option directly contradicts the given information. While an unattached IAM role would indeed lead to the CLI being unable to retrieve instance profile credentials, the problem here is not the absence of the role, but rather the CLI's inability to correctly utilize the credentials provided by the present instance profile due to an override or misconfiguration.
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.