Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is configuring a containerized application running on Amazon ECS that needs to access two settings: a public API endpoint URL (non-sensitive configuration) and a database password for an Amazon RDS database. The database password must be rotated automatically every 30 days. To ensure the design is both secure and cost-effective, which configuration should the developer implement?

  1. Store the public API endpoint URL as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.Answer
  2. B
    Store both the public API endpoint URL and the database password in AWS Secrets Manager, and enable automatic rotation for both parameters.
  3. C
    Store both the public API endpoint URL and the database password as SecureString parameters in AWS Systems Manager Parameter Store, and write a scheduled AWS Lambda function to rotate the password in the database.
  4. D
    Store the public API endpoint URL in Systems Manager Parameter Store, and define the database password as a plaintext environment variable in the ECS task definition.

Answer

Store the public API endpoint URL as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.
The correct configuration uses AWS Systems Manager Parameter Store for non-sensitive parameters like the API endpoint URL, which minimizes costs. It uses AWS Secrets Manager for the database password because Secrets Manager supports native integration with Amazon RDS to automatically rotate the password, fulfilling the security requirement without requiring custom rotation logic.

Step-by-Step Solution

1
Analyze the sensitivity and lifecycle requirements of both configuration settings.
The API endpoint URL is non-sensitive, static configuration, while the database password is highly sensitive and requires automated rotation every 30 days.
This determines which AWS service is best suited for each parameter to optimize for cost and operational efficiency.
2
Select the appropriate storage service for the non-sensitive configuration.
AWS Systems Manager Parameter Store (String parameter) is selected.
Parameter Store standard parameters are free and ideal for non-sensitive configurations, making this the most cost-effective choice.
3
Select the appropriate storage service and rotation mechanism for the database password.
AWS Secrets Manager is selected, configured with the built-in RDS automatic rotation.
Secrets Manager provides native, out-of-the-box integration with Amazon RDS for automated password rotation, meeting the security and rotation requirements with minimal operational overhead.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on sensitivity, automatic rotation requirements, and cost-effectiveness.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic