Utilize Vault CLI and API →mediumMultiple ChoiceObjective-mapped

VA-003 Utilize Vault CLI and API Practice Question

Exhibit

Refer to the exhibit.
auto_auth {
    method {
        type = "aws"
        config = {
            role = "my-role"
        }
    }
}

This Vault agent configuration section is incomplete. What is missing for the AWS auto-auth method to function correctly?

⚠ Common exam trap

HashiCorp often tests the misconception that the AWS auth method requires explicit IAM credentials in the Vault configuration file, when in fact credentials are provided by the client at authentication time, not stored in the server configuration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS credentials must be provided via environment variables or instance metadata

The AWS auth method in Vault requires valid AWS credentials to authenticate against AWS STS. These credentials can be provided via environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or automatically retrieved from instance metadata when running on an EC2 instance. Without them, Vault cannot sign the STS request to verify the caller's identity, causing authentication to fail.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The configuration needs a 'region' parameter
Why it's wrong here
Region is not required for the AWS auth method; credentials are needed.
✗
The role name 'my-role' is invalid
Why it's wrong here
The role name could be any valid role; the missing piece is credentials.
✗
The method type should be 'iam' instead of 'aws'
Why it's wrong here
'aws' is the correct type for the AWS auth method.
✓
AWS credentials must be provided via environment variables or instance metadata
Why this is correct
Vault's AWS auth method requires AWS credentials to authenticate to the AWS API.

Go deeper

VA-003 Utilize Vault CLI and API Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question