Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is building an AWS Lambda function that integrates with an external customer relationship management (CRM) platform. The integration requires a client secret that must be stored securely and rotated automatically every 30 days. Which solution meets these requirements with the least operational overhead?

  1. A
    Hardcode the client secret in the Lambda function's source code, and use a customer managed key in AWS Key Management Service (AWS KMS) to encrypt the function deployment package.
  2. Store the client secret in AWS Secrets Manager. Configure automatic rotation for the secret by defining a rotation schedule of 30 days and using an AWS Lambda function to perform the rotation.Answer
  3. C
    Store the client secret in AWS Systems Manager Parameter Store as a SecureString parameter. Set up an Amazon EventBridge scheduled rule to trigger a custom AWS Lambda function that updates the parameter value every 30 days.
  4. D
    Store the client secret in AWS Systems Manager Parameter Store as a String parameter, and reference the parameter value directly in the Lambda function's environment variables.

Answer

Store the client secret in AWS Secrets Manager, and configure automatic rotation for the secret using a 30-day schedule and an AWS Lambda function to execute the rotation.
AWS Secrets Manager is the optimal service for storing sensitive API keys and secrets that require automatic rotation. It features built-in support for rotating secrets on a defined schedule using a Lambda function. This native integration reduces administrative overhead compared to building custom rotation tools.

Step-by-Step Solution

1
Evaluate the security and rotation requirements for the sensitive CRM client secret.
Identify that the secret must be encrypted and must support automated rotation every 30 days with minimal operational overhead.
This establishes the criteria for selecting between AWS Secrets Manager and Systems Manager Parameter Store.
2
Compare AWS Secrets Manager and AWS Systems Manager Parameter Store features.
Determine that while Parameter Store supports SecureString parameters, it does not offer built-in rotation functionality. Secrets Manager natively supports automatic rotation via Lambda on a schedule.
This eliminates Parameter Store options due to the lack of built-in rotation capabilities.
3
Select the correct option based on security best practices.
Store the secret in Secrets Manager and configure automatic rotation.
This fulfills all requirements with the least operational effort.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store rotation capabilities
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic