Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is building a containerized microservice deployed on Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. The microservice requires access to:

1. A sensitive API key for a third-party SaaS service that requires scheduled rotation every 3030 days.
2. A non-sensitive log level configuration setting (e.g., INFO, DEBUG) that varies between development and production environments.

Which combination of actions should the developer take to configure these parameters securely and cost-effectively? (Select TWO.)

  1. Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic.Answer
  2. Store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.Answer
  3. C
    Store both the third-party API key and the log level setting in AWS Systems Manager Parameter Store as SecureString parameters with an automated Systems Manager association policy for rotation.
  4. D
    Hardcode the log level configuration setting in the application code and store the third-party API key directly in the ECS task definition environment variables.
  5. E
    Store the log level configuration setting in AWS Secrets Manager and configure a standard rotation schedule using a built-in Amazon RDS database rotation template.

Answer

Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic, and store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.
For the sensitive third-party API key, storing it in AWS Secrets Manager allows the developer to configure an AWS Lambda function to handle the required custom 3030-day rotation logic. For the non-sensitive log level configuration, AWS Systems Manager Parameter Store is a cost-effective and simple solution that avoids unnecessary Secrets Manager costs.

Step-by-Step Solution

1
Analyze secret rotation requirements
Identify that the third-party API key requires automated rotation every 3030 days, which is a native feature of AWS Secrets Manager using a custom AWS Lambda function.
Parameter Store does not offer built-in secret rotation schedules, making Secrets Manager the appropriate choice for the API key.
2
Analyze non-sensitive configuration requirements
Identify that the log level setting is non-sensitive and varies per environment, which maps perfectly to AWS Systems Manager Parameter Store String parameters.
Using Parameter Store for non-sensitive data is cost-effective (no cost for standard parameters) compared to AWS Secrets Manager.

Key Concept

Selecting between AWS Secrets Manager and AWS Systems Manager Parameter Store based on sensitivity and rotation requirements.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic