Examkin

Question

Difficulty: HardSecrets Management and Parameter Store

A developer is designing a microservice application deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservice requires access to two types of data: database credentials for an Amazon RDS for PostgreSQL instance that must be automatically rotated every 30 days, and non-sensitive API endpoints for external integration that vary by environment. Which combination of actions should the developer take to store and manage this data securely and cost-effectively? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.Answer
  2. Store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as SecureString parameters, and configure an Amazon EventBridge rule to trigger a custom Lambda function to rotate the credentials.
  4. D
    Store the non-sensitive API endpoints in AWS Secrets Manager to centralize all application configuration and enable automatic rotation.
  5. E
    Hardcode the database credentials in the application's source code and use the AWS SDK to decrypt them at runtime using a customer managed key in AWS KMS.

Answer

Store the database credentials in AWS Secrets Manager with built-in automatic rotation, and store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.
Storing database credentials in AWS Secrets Manager takes advantage of native automatic rotation with Amazon RDS, removing the need to manage custom rotation code. Storing non-sensitive configuration parameters like API endpoints in AWS Systems Manager Parameter Store as String parameters is cost-effective because Parameter Store standard parameters are free, whereas Secrets Manager charges per secret.

Step-by-Step Solution

1
Evaluate the security and rotation requirements for the database credentials.
Identify that database credentials are highly sensitive and need to be rotated automatically every 30 days.
AWS Secrets Manager is the optimal service because it has built-in integration with Amazon RDS to rotate credentials automatically via a pre-configured Lambda function.
2
Evaluate the requirement for the non-sensitive API endpoints.
Identify that API endpoints are non-sensitive and vary by environment, meaning they do not require encryption or automatic rotation.
AWS Systems Manager Parameter Store String parameters are free of charge for standard use cases, making it the most cost-effective solution for non-sensitive configurations.
3
Identify the correct combination of options based on AWS best practices.
Select Secrets Manager for the database secret rotation and Parameter Store String parameters for the non-sensitive configuration data.
This combination fulfills all security requirements while optimizing costs.

Key Concept

Differentiating between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation, and cost requirements.
Estimated Time:2m 0s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic