Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is creating an AWS CloudFormation template to deploy a web application. The application requires access to two configuration values:

1. A database connection password that must support automatic rotation every 30 days.
2. A public API endpoint URL for a third-party service that is non-sensitive and updated infrequently.

To follow security best practices and optimize costs, how should the developer store and reference these values in the CloudFormation template?

  1. A
    Store both the database password and the API endpoint URL in AWS Secrets Manager, and reference both using Secrets Manager dynamic references.
  2. B
    Store both the database password and the API endpoint URL in AWS Systems Manager Parameter Store as SecureString parameters, and reference both using Parameter Store dynamic references.
  3. Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.Answer
  4. D
    Hardcode both the database password and the API endpoint URL as default values in the template's Parameters section, and update them manually in the AWS Console after deployment.

Answer

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference, and store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.
Storing the database password in AWS Secrets Manager and referencing it via a dynamic reference satisfies the security and automatic rotation requirements. Storing the non-sensitive public API endpoint URL in Systems Manager Parameter Store standard parameters satisfies the cost-efficiency constraint because Parameter Store standard parameters are free, and using a dynamic reference allows secure integration without exposure.

Step-by-Step Solution

1
Determine the storage requirements for the database password.
The password requires automatic rotation every 30 days, which points to AWS Secrets Manager as the appropriate service because it integrates with AWS Lambda for automated credential rotation.
Systems Manager Parameter Store does not offer native automatic rotation for secrets.
2
Determine the storage requirements for the non-sensitive public API endpoint.
The endpoint URL is non-sensitive and updated infrequently, making Systems Manager Parameter Store standard parameters the most cost-effective choice since they are free.
Using Secrets Manager for non-sensitive data incurs unnecessary monthly costs.
3
Identify the proper CloudFormation integration method.
Use dynamic references to resolve the values dynamically at runtime (e.g., {{resolve:secretsmanager:...}} and {{resolve:ssm:...}}).
Dynamic references allow CloudFormation to securely retrieve external values during deployment without hardcoding them in the template.

Key Concept

Selecting and referencing the appropriate parameter store or secrets service in CloudFormation based on security, rotation, and cost requirements.
Estimated Time:1m 30s
Rate this question

Topics

AWS CloudFormation

More questions from this topic