Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is designing a serverless data ingestion application on AWS Lambda. The application requires access to a third-party service API key that must be rotated automatically every 30 days, as well as a non-sensitive database port number that does not change. To minimize cost and operational overhead, which two actions should the developer take to store and manage these parameters? (Select TWO.)

  1. Store the API key in AWS Secrets Manager and configure a Lambda function to handle the rotation.Answer
  2. Store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.Answer
  3. C
    Store both the API key and the database port number in AWS Secrets Manager to centralize credential storage.
  4. D
    Store the API key in Systems Manager Parameter Store as a SecureString parameter and configure the native Parameter Store auto-rotation policy.
  5. E
    Hardcode the API key directly in the Lambda function's source code to avoid external service calls.

Answer

Store the API key in AWS Secrets Manager with a Lambda rotation function, and store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.
The correct options are to store the API key in AWS Secrets Manager with a Lambda rotation function, and to store the database port in AWS Systems Manager Parameter Store as a Standard parameter. AWS Secrets Manager is appropriate because it supports automatic rotation out-of-the-box. Systems Manager Parameter Store Standard parameters are the correct choice for non-sensitive data because they do not incur a monthly configuration cost.

Step-by-Step Solution

1
Analyze the requirements for the API key
The API key is highly sensitive and requires automatic rotation every 30 days.
AWS Secrets Manager is designed for storing secrets and provides native integration with AWS Lambda to rotate secrets automatically.
2
Analyze the requirements for the database port number
The database port is non-sensitive and static.
AWS Systems Manager Parameter Store is ideal for storing non-sensitive configuration parameters. Standard parameters are free of charge, helping minimize costs.
3
Select the optimal combination of services to minimize cost and overhead
Use Secrets Manager for the API key to handle automatic rotation, and Parameter Store for the port number to avoid Secrets Manager costs.
This separation aligns with the AWS well-architected best practices of cost optimization and security.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on cost, sensitivity, and automatic rotation requirements.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic