Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is implementing a serverless payment microservice using AWS Lambda. The microservice needs to securely access a third-party API key that must be rotated every 90 days. Which solution should the developer implement to manage and rotate this API key with the lowest operational overhead?

  1. A
    Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter. Configure a recurring Amazon EventBridge rule that triggers a Lambda function to update the parameter value.
  2. Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret, and associate a custom AWS Lambda function to execute the rotation steps with the payment provider.Answer
  3. C
    Embed the API key directly in the Lambda function's deployment package as a static configuration file. Configure the AWS SDK inside the Lambda function to decrypt the file at runtime using a customer managed key.
  4. D
    Store the API key in AWS Systems Manager Parameter Store as a String parameter. Enable the built-in Parameter Store auto-rotation feature and link it to the Lambda function's execution role.

Answer

Store the API key in AWS Secrets Manager, configure automatic rotation, and associate a custom AWS Lambda function to handle the rotation lifecycle events with the third-party payment provider.
AWS Secrets Manager is designed to store, manage, and rotate secrets. For third-party APIs that do not have built-in rotation integration in AWS, Secrets Manager allows you to configure automatic rotation by invoking a custom AWS Lambda function. This custom function implements the rotation logic (e.g., creating a new key with the provider and updating the secret value) automatically on the set schedule, minimizing operational overhead.

Step-by-Step Solution

1
Identify the requirement for secure credential storage with automatic rotation for a third-party API key.
Determine that AWS Secrets Manager is the primary AWS service designed for secrets management and automated rotation of credentials.
AWS Systems Manager Parameter Store does not support native rotation, and embedding secrets in code or deployment packages violates security best practices.
2
Configure the rotation schedule in AWS Secrets Manager.
Enable automatic rotation for the secret and specify a rotation schedule of 90 days.
Secrets Manager requires an orchestration schedule to run the rotation process periodically.
3
Develop and associate a custom AWS Lambda function with the Secrets Manager secret.
The custom Lambda function handles the rotation steps: creating a new version of the secret, testing it against the third-party provider, and finalizing the rotation.
Standard automatic rotation templates exist for AWS databases, but custom APIs require a custom rotation Lambda function to communicate with the external service.

Key Concept

Secrets Management and Parameter Store
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic