Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is building a serverless orchestration workflow using AWS Step Functions. One of the workflow's task states invokes an AWS Lambda function that integrates with a third-party merchant API. The merchant API requires a secure API key for authentication. The company's security policy requires that this API key be rotated every 30 days. Which solution meets these requirements with the least operational overhead?

  1. Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret on a 30-day schedule using a rotation Lambda function, and configure the integration Lambda function to retrieve the secret at runtime.Answer
  2. B
    Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store. Create an Amazon EventBridge rule that runs a custom Lambda function every 30 days to generate a new key and update the parameter value.
  3. C
    Store the API key as an encrypted environment variable in the integration Lambda function's configuration using AWS Key Management Service (AWS KMS). Implement a custom helper function inside the application code to handle rotation.
  4. D
    Store the API key as a Standard parameter in AWS Systems Manager Parameter Store. Enable the native Parameter Store automatic rotation feature and configure it for a 30-day rotation interval.

Answer

Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret on a 30-day schedule using a rotation Lambda function, and configure the integration Lambda function to retrieve the secret at runtime.
The correct option is to use AWS Secrets Manager with its built-in automatic rotation feature, configured with a rotation Lambda function on a 30-day schedule. AWS Secrets Manager is specifically designed for managing, rotating, and retrieving secrets securely at runtime, which satisfies the requirements with the lowest operational overhead.

Step-by-Step Solution

1
Evaluate the need for encryption and automatic rotation of credentials.
Identify that AWS Secrets Manager is the standard service designed to handle secrets requiring automatic rotation natively.
Systems Manager Parameter Store does not offer native automatic rotation out of the box.
2
Compare Secrets Manager and Systems Manager Parameter Store for custom third-party secrets.
Choose Secrets Manager because it supports automatic rotation via custom Lambda functions, minimizing custom orchestration code.
Implementing rotation in Parameter Store requires custom EventBridge rules and manual orchestration, increasing operational overhead.
3
Ensure the integration Lambda function retrieves the secret at runtime.
Avoid hardcoding or environment variables that complicate rotation and compromise security.
Retrieving the secret at runtime ensures that rotation does not break the integration Lambda function.

Key Concept

Secrets Manager vs Systems Manager Parameter Store Rotation Capabilities
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic