A serverless application running on AWS Lambda needs to retrieve configuration data. This includes a database hostname, which is a non-sensitive configuration parameter, and a database password, which is a sensitive credential that must be rotated automatically every month. Which two options describe the most secure and cost-effective locations to store these values? (Select TWO.)
- Secrets Manager to store the database passwordAnswer
- Systems Manager Parameter Store to store the database hostnameAnswer
- CSystems Manager Parameter Store to store the database password
- DSecrets Manager to store the database hostname
- EHardcode the database password directly in the application code when initializing the database client
Answer
Secrets Manager should be used to store the database password because it supports automatic rotation, while Systems Manager Parameter Store should be used to store the database hostname to optimize costs for non-sensitive configuration data.
Storing the database password in Secrets Manager satisfies the requirement for automatic rotation. Storing the database hostname in Systems Manager Parameter Store provides a cost-effective solution for non-sensitive configuration data that does not need rotation.
Step-by-Step Solution
Key Concept
Distinguishing between Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost-efficiency.
Estimated Time:1m 0s