Examkin

Question

Difficulty: Very hardSecrets Management and Parameter Store

A developer is designing a serverless payment processing application running on AWS Lambda. The application must retrieve the following credentials and configuration settings securely:

1. A third-party API key that is manually rotated every 90 days and must be securely accessed by Lambda functions running in different AWS accounts.
2. A database credential for an Amazon RDS PostgreSQL database that requires automatic rotation every 30 days without causing application downtime.
3. Non-sensitive application configuration parameters (such as timeout limits and connection pool sizes) that must be stored hierarchically and retrieved at minimal cost.

Which of the following configuration options should the developer select to meet these requirements? (Select TWO).

  1. Store the RDS database credentials and the third-party API key in AWS Secrets Manager, attaching a resource-based policy to the API key secret to grant read access to the Lambda functions in the other AWS accounts.Answer
  2. Store the non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store using hierarchical paths.Answer
  3. C
    Store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter, and configure a resource-based policy on the parameter to allow the other AWS accounts to retrieve it.
  4. D
    Store the database credentials in AWS Systems Manager Parameter Store, and configure an Amazon EventBridge rule that triggers an AWS Lambda function to rotate the credentials in RDS and update the parameter value.
  5. E
    Hardcode the third-party API key directly in the Lambda function's source code to avoid API retrieval latency, and use the default credential provider chain to authenticate the database client.

Answer

Store the database credentials and the third-party API key in AWS Secrets Manager, utilizing a resource-based policy for cross-account access to the API key, and store non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store.
The correct architecture leverages AWS Secrets Manager for secrets requiring automatic rotation or cross-account access via resource-based policies, and AWS Systems Manager Parameter Store for cost-effective hierarchical configuration storage. Database credentials require automatic rotation, which is a native feature of AWS Secrets Manager for Amazon RDS. The third-party API key needs cross-account access, which is supported in Secrets Manager using resource-based policies. Non-sensitive configurations are best stored as Standard parameters in Parameter Store, as they are free and support hierarchical paths.

Step-by-Step Solution

1
Analyze the database credential rotation requirement.
Identify that Amazon RDS database credentials require automatic rotation every 30 days.
AWS Secrets Manager natively supports automatic rotation of RDS credentials without custom Lambda code or downtime.
2
Analyze the third-party API key sharing requirement.
Identify that the API key needs to be securely shared cross-account.
AWS Secrets Manager supports resource-based policies, allowing direct cross-account access without assuming cross-account IAM roles, unlike Systems Manager Parameter Store.
3
Analyze the non-sensitive configuration storage requirement.
Identify that non-sensitive settings need hierarchical storage at minimal cost.
Systems Manager Parameter Store Standard parameters are free of charge, support hierarchical paths, and are the most cost-effective choice for non-sensitive data.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation, cross-account access capabilities, and cost efficiency.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic