Examkin

Question

Difficulty: EasyAWS CloudFormation

A developer is writing an AWS CloudFormation template to deploy a web application. The application requires access to a database password that must be rotated automatically every 30 days.

Which approach should the developer use to reference this password in the CloudFormation template while meeting the security requirements?

  1. Retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager.Answer
  2. B
    Retrieve the database password in the template by referencing a standard parameter stored in AWS Systems Manager Parameter Store.
  3. C
    Manually update the database password directly in the database instance and use CloudFormation drift detection to automatically synchronize the template with the new password.
  4. D
    Update the password parameter in the CloudFormation template during a stack update, and if the update fails, allow the stack to remain in the ROLLBACK_IN_PROGRESS state to re-attempt the password rotation.

Answer

Retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager.
The correct option is to retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager. Secrets Manager is designed specifically to handle sensitive information and provides built-in integration for automatic rotation of credentials. CloudFormation can securely fetch the current version of the secret during deployment using dynamic references.

Step-by-Step Solution

1
Identify the rotation requirement.
The requirement specifies that the database password must be rotated automatically every 30 days.
AWS Secrets Manager natively supports automatic secrets rotation using AWS Lambda, whereas Systems Manager Parameter Store does not have a native, out-of-the-box automatic rotation feature.
2
Integrate the secret with CloudFormation.
Configure a dynamic reference pattern like '{{resolve:secretsmanager:secret-id}}' within the CloudFormation resource properties.
This allows CloudFormation to fetch the latest version of the secret at deployment time without hardcoding it or exposing it in plaintext.

Key Concept

AWS CloudFormation Dynamic References with AWS Secrets Manager
Rate this question

Topics

AWS CloudFormation

More questions from this topic