Examkin

Question

Difficulty: HardSecrets Management and Parameter Store

A developer is building a multi-region active-active web application deployed across `us-east-1` and `us-west-2` using AWS Lambda. The application must securely retrieve a database credential that requires automatic rotation every 3030 days, as well as a region-specific database connection endpoint URL that is non-sensitive. The solution must minimize cross-region latency for credential retrieval and optimize cost. Which combination of services and configuration should the developer use to meet these requirements?

  1. A
    Store the database credential as a SecureString parameter in AWS Systems Manager Parameter Store in `us-east-1` with cross-region replication enabled. Store the connection endpoint URL in AWS Secrets Manager as a secret replicated to `us-west-2`.
  2. Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.Answer
  3. C
    Store both the database credential and the connection endpoint URL in a single secret in AWS Secrets Manager in `us-east-1`, replicate it to `us-west-2`, and hardcode AWS IAM access keys in the Lambda function code to decrypt and retrieve the secret across regions.
  4. D
    Store the database credential in AWS Secrets Manager in `us-east-1` and write a custom Lambda function to copy the secret value to `us-west-2` after each rotation. Store the connection endpoint URL as a SecureString parameter in AWS Systems Manager Parameter Store in `us-east-1` and access it across regions.

Answer

Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.
Storing the database credential in AWS Secrets Manager meets the requirement for automatic rotation, and replication to the secondary region ensures low-latency local access. Utilizing Systems Manager Parameter Store for the connection endpoint is cost-effective, and storing it as a regional parameter in each region eliminates cross-region latency.

Step-by-Step Solution

1
Analyze credential requirements
Database credentials require security, automatic rotation, and cross-region availability with minimum latency.
AWS Secrets Manager is designed for managing sensitive secrets, supporting automated rotation and built-in cross-region replication.
2
Analyze non-sensitive configuration requirements
The connection endpoint is region-specific, non-sensitive, and needs to be retrieved cost-effectively.
AWS Systems Manager Parameter Store is ideal and cost-effective for storing non-sensitive config parameters, and storing them as regional parameters avoids cross-region latency.
3
Assess IAM and replication configurations
Identify the solution that avoids custom replication code and hardcoded credentials.
Native Secrets Manager replication handles cross-region secret syncing automatically, and using Lambda execution roles avoids hardcoding credentials.

Key Concept

Selecting the correct secret and parameter management service based on sensitivity, replication, rotation, and cost constraints.
Estimated Time:2m 0s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic