Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is designing an AWS CloudFormation template to deploy a microservice. The microservice requires access to a database password that must be automatically rotated every 30 days, as well as a non-sensitive API endpoint URL for an external service. Which two configuration strategies should the developer use to reference these values in the CloudFormation template to ensure security, rotation support, and cost-efficiency? (Select TWO.)

  1. Reference the database password dynamically in the template using an AWS Secrets Manager dynamic reference.Answer
  2. Reference the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.Answer
  3. C
    Store the database password in a standard AWS Systems Manager Parameter Store parameter and configure Parameter Store to handle the 30-day rotation.
  4. D
    Store both the database password and the non-sensitive API endpoint URL in AWS Secrets Manager, referencing both using Secrets Manager dynamic references.
  5. E
    Deploy the resources using placeholder values in the template, and then run a script to update the database password and API endpoint directly on the resources via the AWS CLI.

Answer

Referencing the database password dynamically in the template using an AWS Secrets Manager dynamic reference, and referencing the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.
For sensitive credentials requiring automatic rotation, the correct practice is to store them in AWS Secrets Manager and reference them via an AWS Secrets Manager dynamic reference. For non-sensitive configurations that do not need rotation, the correct and cost-efficient practice is to store them in AWS Systems Manager Parameter Store and reference them via a Parameter Store dynamic reference.

Step-by-Step Solution

1
Identify the security and rotation requirements for the sensitive database password.
Determine that AWS Secrets Manager is required because it supports native automatic rotation and encryption.
Secrets Manager is built to securely store sensitive data and automate rotation workflows.
2
Identify the requirements for the non-sensitive API endpoint URL.
Determine that AWS Systems Manager Parameter Store is the most appropriate service.
Parameter Store is more cost-effective for non-sensitive data and configuration parameters that do not require rotation.
3
Integrate both services into the CloudFormation template using dynamic references.
The template securely fetches the values at runtime without exposing them in plaintext or risking resource drift.
Dynamic references allow CloudFormation to retrieve external configuration values securely when the stack is created or updated.

Key Concept

Securely referencing sensitive credentials and non-sensitive configurations in AWS CloudFormation templates using Secrets Manager and Systems Manager Parameter Store.
Rate this question

Topics

AWS CloudFormation

More questions from this topic