Which security feature must be provisioned for AWS CLI access?
A developer needs to interact with AWS by using the AWS CLI. Which security feature or AWS service must be provisioned in the developer's account to meet this requirement?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the split between console credentials and programmatic credentials in AWS access management, and the trap is assuming the IAM user's console sign-in password (or root password) can authenticate CLI calls.
The AWS CLI authenticates programmatic requests with an AWS access key — an access key ID paired with a secret access key — rather than a console user name and password. This page confirms that option D, the AWS access key, is the credential the developer must have provisioned in the account before any CLI command can be signed.
Most learners are drawn to option A, 'User name and password', because that is how they sign in to the AWS Management Console — but that credential pair only works for browser-based sign-in, never for signing AWS CLI or SDK API requests.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Interacting with AWS through the AWS CLI is programmatic access, and AWS requires a signed request for every API call the CLI makes. That signature is generated from an AWS access key, meaning an access key ID plus its matching secret access key, which is exactly what option D describes. An IAM user (or an IAM Identity Center / assumed role session) that has an access key provisioned is what makesaws configure and subsequent CLI commands work at all. Without an access key the CLI has no way to identify and authenticate the caller, so option D is the security feature that must be provisioned in the developer's account.Why the Other Options Are Wrong
Option A, a user name and password, is the credential used for interactive console sign-in; it is not accepted by the AWS CLI, which supports SigV4 request signing, not browser-style form login. Option C, root password access, is both wrong and dangerous — the root user can technically create an access key, but AWS strongly advises against using root credentials for everyday programmatic work, so it is never the recommended provisioning step. Option B, AWS Systems Manager, is an operations service for patching, inventory, session management and parameter storage; it is not a credential and cannot authenticate a CLI request by itself. None of these three provides the signing material the CLI needs.Community Comment Notes
Every learner answering this item converged on the same choice: its_tima commented "D. Access key for programmatic access*", explicitly tying the answer to programmatic use of the CLI. ShaiTay and d00b229 both answered with the plain phrase "D. AWS access key", reinforcing that the community treats the access key ID / secret access key pair as the credential that satisfies this scenario. The unanimous vote record (D: 100) matches the reasoning above, and in this case the community majority and the source key both agree with the technical analysis.Official Reference
Exam Strategy
When a scenario mentions the AWS CLI, SDK, or any 'programmatic access', immediately map it to access keys (or a temporary credential from a role) rather than console sign-in credentials. CLF-C02 repeatedly contrasts 'console password' with 'access key' to test whether you understand AWS access management capabilities.
Frequently Asked Questions
Why can't I use the IAM user name and password for the AWS CLI?
Console sign-in credentials only work in the browser-based Management Console. The CLI sends signed API requests, which require an access key ID and secret access key instead.
Does AWS Systems Manager eliminate the need for CLI access keys?
Systems Manager can run commands and open sessions, but it is an operations service, not a credential. It does not replace the access key needed to sign AWS CLI requests.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →