Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

An enterprise web application running on Amazon EC2 instances needs to authenticate with an Amazon RDS for PostgreSQL database. The database password must be rotated every 30 days to comply with security requirements. The developer wants to implement a secure solution that automates the rotation process with the least operational overhead. Which approach should the developer take to meet these requirements?

  1. Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.Answer
  2. B
    Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store. Enable built-in automatic rotation in the Parameter Store settings for RDS and configure a rotation interval of 30 days.
  3. C
    Store the database credentials in a secure configuration file packaged with the application. Initialize the AWS SDK client inside the application by hardcoding temporary IAM user access keys that have permission to read the configuration file.
  4. D
    Store the database password as a standard String parameter in AWS Systems Manager Parameter Store. Use a local cron job on the EC2 instances to retrieve the parameter using hardcoded AWS access keys and rotate the password in the database.

Answer

Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.
AWS Secrets Manager natively supports automatic rotation of database credentials, including built-in templates for Amazon RDS databases. By enabling rotation and selecting the target RDS database, Secrets Manager automatically updates the database password and the secret value at the specified interval using a managed Lambda function. The application can query Secrets Manager via the AWS SDK at runtime using IAM roles, ensuring it always uses the current credentials without requiring code changes or redeployments.

Step-by-Step Solution

1
Identify the security requirements: password rotation every 30 days, minimal operational overhead, and secure runtime access by the application.
Recognize that database credential rotation is natively supported by AWS Secrets Manager for Amazon RDS databases, whereas Parameter Store lacks native database rotation integration.
Choosing the service with native rotation integration minimizes custom script maintenance and operational overhead.
2
Evaluate the credential retrieval method from the application running on EC2.
Ensure the application retrieves the database password dynamically at runtime using the AWS SDK, authenticated via temporary credentials from an IAM instance profile.
Dynamic retrieval ensures the application uses the latest password post-rotation, and IAM instance profiles avoid the security risk of hardcoding AWS access keys.

Key Concept

AWS Secrets Manager native RDS rotation vs Systems Manager Parameter Store configuration
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic