Examkin

Question

Difficulty: HardSecrets Management and Parameter Store

A developer is configuring a containerized microservice deployed on AWS App Runner that needs to access a secure legacy database running on-premises and a third-party logistics API. The database credentials must be rotated automatically every 30 days using a custom rotation function that interacts with the on-premises database via an AWS Direct Connect connection. The third-party logistics API key is static, does not require automated rotation, and needs to be shared across multiple development environments cost-effectively. Which combination of steps should the developer take to manage these credentials in compliance with security best practices? (Select TWO.)

  1. Store the on-premises database credentials in AWS Secrets Manager, and configure a custom rotation Lambda function associated with a VPC to rotate the password every 30 days.Answer
  2. Store the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter to leverage its free tier and cross-environment accessibility.Answer
  3. C
    Store the on-premises database credentials in AWS Systems Manager Parameter Store as a SecureString parameter, and configure a native Parameter Store rotation hook to update the database password.
  4. D
    Embed the third-party logistics API key directly in the container image's Dockerfile as an environment variable to ensure fast startup times on AWS App Runner.
  5. E
    Store both the database credentials and the API key in AWS Secrets Manager, and use the default RDS rotation template to automate the rotation of both secrets simultaneously.

Answer

The developer should store the on-premises database credentials in AWS Secrets Manager and configure a custom rotation Lambda function associated with a VPC to rotate the password, while storing the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database credentials require automated rotation and access to an on-premises network over Direct Connect, which is best handled by AWS Secrets Manager using a custom VPC-configured Lambda function. For the static API key that does not require automatic rotation, AWS Systems Manager Parameter Store SecureString is the most cost-effective option since standard parameters do not incur a monthly fee.

Step-by-Step Solution

1
Analyze rotation and network requirements for the database credentials.
Since the legacy database is on-premises and requires automatic 30-day rotation, AWS Secrets Manager is selected. A custom Lambda function is required because native templates do not support on-premises targets. The Lambda function must be associated with a VPC to route traffic over AWS Direct Connect.
Secrets Manager provides native scheduling for rotation, and custom Lambda functions can be deployed inside a VPC to access private or on-premises networks.
2
Analyze rotation and cost requirements for the static API key.
Since the third-party logistics API key is static, does not require automated rotation, and needs to be shared across environments cost-effectively, AWS Systems Manager Parameter Store is selected as a SecureString parameter.
Parameter Store standard parameters are free, making it the most cost-effective choice for secrets that do not require the automatic rotation feature of Secrets Manager.
3
Ensure secure reference and deployment architectures.
Avoid embedding any credentials in the Dockerfile or application source code, and retrieve them dynamically at runtime from their respective parameter store and secrets manager locations.
This prevents credential leakage via image registries or source repositories.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation requirements, network path constraints, and cost optimization.
Estimated Time:2m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic