A developer is deploying an application to a fleet of Amazon EC2 instances in an Auto Scaling group. The application needs to retrieve two configuration settings: a database password for an Amazon Aurora PostgreSQL database that must be rotated automatically every 30 days, and a non-sensitive external API endpoint URL. The developer wants to minimize operational overhead and cost. Which combination of actions should the developer take to store these configurations? (Select TWO.)
- Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.Answer
- Store the external API endpoint URL as a Standard parameter in AWS Systems Manager Parameter Store.Answer
- CStore the database password in AWS Systems Manager Parameter Store as a SecureString parameter and configure Parameter Store native automatic rotation.
- DHardcode the database password inside the application's configuration file and retrieve it using the AWS SDK.
- EStore the external API endpoint URL in AWS Secrets Manager as a secret and configure it to use the free Standard tier.
Answer
Store the database password in AWS Secrets Manager with Lambda-based automatic rotation, and store the non-sensitive external API endpoint URL as a Standard parameter in AWS Systems Manager Parameter Store.
Storing the database password in AWS Secrets Manager allows the developer to easily schedule and automate rotation using AWS Lambda. Storing the non-sensitive API endpoint URL as a Standard parameter in Systems Manager Parameter Store is the most cost-effective approach since Parameter Store's Standard tier does not charge for storage or API interactions under normal limits, whereas Secrets Manager charges per secret.
Step-by-Step Solution
Key Concept
Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation requirements and cost-efficiency.
Estimated Time:1m 30s