Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

An organization requires a developer to build a secure configuration strategy for an application running on AWS Lambda. The application must connect to an Amazon RDS PostgreSQL database, which requires credentials to be rotated every 30 days. The application also needs to access non-sensitive service configuration parameters that change frequently. To minimize costs and management overhead, which of the following actions should the developer take? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation.Answer
  2. Store the non-sensitive service configuration parameters as standard parameters in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as SecureString parameters and write a custom AWS Lambda function to handle rotation.
  4. D
    Pass hardcoded IAM access keys directly into the AWS SDK client initialization code to authenticate requests to Secrets Manager.
  5. E
    Store the non-sensitive service configuration parameters in AWS Secrets Manager to simplify credential management.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation configured, and store the non-sensitive service configuration parameters as standard parameters in AWS Systems Manager Parameter Store.
Storing database credentials in AWS Secrets Manager with automatic rotation configured satisfies the security requirement natively. Storing non-sensitive configuration parameters in AWS Systems Manager Parameter Store standard parameters satisfies the cost-effectiveness requirement, as standard parameters in Parameter Store do not incur any additional charges.

Step-by-Step Solution

1
Identify the storage requirements for the database credentials, which include secure storage and automatic rotation every 30 days.
Determine that AWS Secrets Manager is the appropriate service because it natively supports secret rotation for databases.
Systems Manager Parameter Store does not offer built-in automatic rotation.
2
Identify the storage requirements for the non-sensitive configuration parameters, which need to be updated frequently and stored cost-effectively.
Determine that Systems Manager Parameter Store standard parameters are the best choice since they are free.
Storing non-sensitive values in Secrets Manager incurs unnecessary costs.
3
Ensure secure SDK initialization inside the Lambda function without hardcoding credentials.
Determine that IAM roles should be used for authentication instead of passing hardcoded access keys in the code.
Hardcoding credentials in the SDK initialization violates security best practices.

Key Concept

Selecting the appropriate AWS service (Secrets Manager vs. Parameter Store) based on rotation requirements and cost-effectiveness, while adhering to secure credential management practices.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic