Examkin

Question

Difficulty: EasySecrets Management and Parameter Store

An application deployed on Amazon EC2 instances must connect to an external database. The developer needs to store the database endpoint URL, which is non-sensitive, and the database credentials, which must be rotated automatically every 30 days. Which combination of actions should the developer take to configure these parameters in a secure and cost-effective manner? (Select TWO.)

  1. Store the non-sensitive database endpoint URL as a Parameter Store parameter.Answer
  2. Store the database credentials in AWS Secrets Manager with automatic rotation enabled.Answer
  3. C
    Store the database credentials as a String parameter in Systems Manager Parameter Store and create a custom AWS Lambda function for rotation.
  4. D
    Store both the database endpoint URL and the database credentials in AWS Secrets Manager as a single secret.
  5. E
    Hardcode the database credentials directly in the application configuration files.

Answer

Store the non-sensitive database endpoint URL as a Parameter Store parameter, and store the database credentials in AWS Secrets Manager with automatic rotation enabled.
Storing the non-sensitive database endpoint in Systems Manager Parameter Store provides a low-cost, fully-managed configuration store. Storing the sensitive database credentials in AWS Secrets Manager provides native automated credentials rotation, which meets security requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify parameter sensitivity and rotation requirements.
The database endpoint URL is non-sensitive and does not require rotation. The database credentials are sensitive and require regular rotation.
Correct classification helps in choosing the most cost-effective and secure service.
2
Select the appropriate AWS service for each parameter class.
Use Systems Manager Parameter Store for the endpoint URL, and use AWS Secrets Manager for the database credentials.
Parameter Store offers cost-effective storage for configuration parameters, whereas Secrets Manager provides out-of-the-box automatic rotation for sensitive credentials.

Key Concept

Selecting between Systems Manager Parameter Store and AWS Secrets Manager based on credential sensitivity and automatic rotation requirements.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic