Examkin

Question

Difficulty: EasySecrets Management and Parameter Store

A developer is deploying a serverless microservice on AWS Lambda that requires access to an Amazon RDS database. The developer needs to store the database host URL (non-sensitive configuration) and the database password (sensitive credential). The database password must be automatically rotated every 30 days. Which combination of actions should the developer take to meet these requirements in the most secure and cost-effective manner? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and enable automatic rotation.Answer
  2. Store the database host URL as a String parameter in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter and configure scheduled automatic rotation.
  4. D
    Hardcode the database password directly within the Lambda function code to minimize configuration overhead.
  5. E
    Store both the database host URL and the database password in AWS Secrets Manager as a single JSON secret with automatic rotation enabled.

Answer

The developer should store the database password in AWS Secrets Manager with automatic rotation enabled, and store the database host URL in AWS Systems Manager Parameter Store.
The correct options are storing the database password in AWS Secrets Manager and storing the database host URL in AWS Systems Manager Parameter Store. Storing the password in AWS Secrets Manager ensures security and enables native automatic rotation (especially for RDS). Storing the host URL in Systems Manager Parameter Store is the most cost-effective solution for non-sensitive configuration details because standard parameters in Parameter Store are free, avoiding unnecessary Secrets Manager fees.

Step-by-Step Solution

1
Identify the sensitivity of the data and rotation requirements.
The host URL is non-sensitive, whereas the database password is a sensitive credential requiring automatic rotation.
This allows selecting the most secure and cost-effective service for each type of configuration data.
2
Determine the appropriate service for the sensitive database password.
AWS Secrets Manager is chosen because it supports automatic rotation natively, particularly for Amazon RDS.
Systems Manager Parameter Store does not natively support automatic rotation.
3
Determine the appropriate service for the non-sensitive host URL.
AWS Systems Manager Parameter Store (standard String parameter) is chosen because it is free of charge and ideal for plain text configuration parameters.
Storing non-sensitive data in AWS Secrets Manager would incur unnecessary costs.

Key Concept

Selecting the appropriate secrets management service based on sensitivity, rotation requirements, and cost-efficiency.
Estimated Time:1m 0s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic