Examkin

Question

Difficulty: HardSecrets Management and Parameter Store

A developer is configuring an application deployed on AWS App Runner in Account A. The application needs to retrieve database credentials to connect to an Amazon RDS database hosted in Account B. The database credentials must be rotated automatically every 30 days. Additionally, the application requires access to a public API endpoint URL that is non-sensitive and does not change. The developer wants to implement a secure, cost-effective parameter storage solution that allows cross-account access where necessary. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager in Account B, configure automatic rotation, and attach a resource-based policy to the secret that grants retrieve permissions to the App Runner instance role in Account A.Answer
  2. Store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A as a Standard String parameter.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store in Account B as a SecureString parameter, and attach a resource-based policy to the parameter to grant access to Account A.
  4. D
    Store the public API endpoint URL in AWS Secrets Manager in Account A, and configure a custom Lambda function to rotate the URL daily to optimize storage costs.
  5. E
    Hardcode the database credentials in the application's configuration file within the App Runner container image, and restrict access to the container image using Amazon ECR repository policies.

Answer

Store the database credentials in AWS Secrets Manager in Account B with a resource-based policy granting access to Account A, and store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A as a Standard String parameter.
The correct options are to store the database credentials in AWS Secrets Manager in Account B with a resource-based policy, and store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A. AWS Secrets Manager supports automatic rotation and allows direct cross-account access via resource-based policies. Systems Manager Parameter Store is a cost-effective choice for non-sensitive, static configurations since standard parameters have no storage costs.

Step-by-Step Solution

1
Evaluate credential storage and sharing requirements.
Database credentials need to be stored in Account B, rotated every 30 days, and accessed by Account A. AWS Secrets Manager supports automatic rotation and resource-based policies, which allow cross-account sharing directly.
This satisfies the security requirement for automatic rotation and cross-account access.
2
Evaluate non-sensitive configuration storage.
The public API endpoint URL is non-sensitive and static. AWS Systems Manager Parameter Store Standard parameters are ideal because they are free and do not require rotation.
This satisfies the cost-effectiveness requirement.
3
Configure permissions for Account A's App Runner service.
Attach a resource-based policy to the Secrets Manager secret in Account B, specifying the App Runner instance role ARN from Account A as the principal with 'secretsmanager:GetSecretValue' permissions.
This enables secure retrieval of the credentials without hardcoding them or setting up complex cross-account IAM role assumption.

Key Concept

Secrets Manager vs Parameter Store feature comparison, including rotation, pricing, and cross-account capabilities.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic