Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A company is deploying a microservices-based application on Amazon Elastic Container Service (Amazon ECS). The application requires access to two types of data: database credentials for an Amazon RDS database that must be rotated automatically every 14 days, and a non-sensitive configuration setting indicating the application's logging level. The developer wants to implement a secure solution that minimizes both management overhead and overall cost. Which of the following actions should the developer take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS.Answer
  2. Store the logging level configuration in Systems Manager Parameter Store as a Standard parameter to optimize costs.Answer
  3. C
    Store both the database credentials and the logging level configuration in AWS Secrets Manager to centralize management and leverage automatic rotation for all settings.
  4. D
    Store the database credentials in a Systems Manager Parameter Store SecureString parameter and write a custom Lambda function triggered by Amazon EventBridge to rotate the RDS password.
  5. E
    Hardcode the database credentials within the Dockerfile environment variables and store the logging level configuration in Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS, and store the logging level configuration in Systems Manager Parameter Store as a Standard parameter to optimize costs.
The correct options involve storing the database credentials in AWS Secrets Manager and the logging level in Systems Manager Parameter Store. AWS Secrets Manager natively integrates with Amazon RDS to provide automatic credential rotation without manual overhead, which satisfies the 14-day rotation requirement. Systems Manager Parameter Store Standard parameters are free of charge, making them the most cost-effective choice for storing non-sensitive configuration settings like application logging levels.

Step-by-Step Solution

1
Evaluate the database credential requirements for automatic rotation.
AWS Secrets Manager is selected because it has built-in integration with Amazon RDS to rotate credentials automatically without manual coding.
This satisfies the security requirement for rotating credentials every 14 days with minimal administrative overhead.
2
Evaluate the configuration setting requirement for cost-effectiveness.
Systems Manager Parameter Store is selected because Standard parameters are free of charge and suitable for non-sensitive data.
This minimizes overall costs by avoiding the hosting fees associated with AWS Secrets Manager for non-sensitive configuration data.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation capabilities and cost optimization.
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic