Examkin

Question

Difficulty: HardSecrets Management and Parameter Store

An organization hosts a critical multi-region web application on Amazon ECS Fargate across the us-east-1 and us-west-2 Regions. The application connects to an Amazon Aurora Global Database. A developer needs to design a secure solution to manage the database password. The password must be rotated every 30 days, and ECS tasks in both Regions must be able to retrieve the credentials locally with minimal latency. Which solution meets these requirements with the least operational overhead?

  1. A
    Store the database credentials as a SecureString parameter in AWS Systems Manager Parameter Store in us-east-1 and us-west-2. Configure an AWS Lambda function triggered by an Amazon EventBridge scheduled rule to update the database password, update the parameter in the primary Region, and copy it to the secondary Region.
  2. B
    Store the database credentials in AWS Secrets Manager in the primary Region. In the ECS task application code, initialize the AWS SDK client using hardcoded IAM user access keys to authenticate and retrieve the secret value from the primary Region during application startup.
  3. C
    Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).
  4. Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Execution Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).Answer

Answer

Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Execution Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).
The correct solution leverages AWS Secrets Manager's native support for automatic rotation of database credentials using built-in AWS Lambda rotation templates. Replicating the secret to the secondary Region ensures that ECS Fargate tasks can retrieve the secret locally, minimizing latency. To inject secrets as environment variables during task startup, the ECS container agent retrieves the secret, which requires the necessary permissions to be attached to the ECS Task Execution Role, rather than the ECS Task Role.

Step-by-Step Solution

1
Identify the service that natively supports automatic credential rotation and multi-region replication.
AWS Secrets Manager supports automatic rotation for Amazon RDS/Aurora and cross-region replication, whereas Parameter Store lacks these native features.
Using Secrets Manager minimizes custom replication and rotation scripts, satisfying the low operational overhead requirement.
2
Determine how ECS tasks retrieve secrets during container startup.
ECS allows injecting secrets directly into environment variables using the valueFrom parameter in the container definition.
Injecting secrets directly prevents them from being exposed in the task definition plaintext or application logs.
3
Identify the correct IAM role needed for secret injection.
The ECS Task Execution Role is used by the ECS container agent to pull images and retrieve secrets, while the ECS Task Role is for application code API calls.
Granting permission to the Task Execution Role ensures the ECS agent can retrieve the secret from Secrets Manager to spin up the container successfully.

Key Concept

Database credential rotation, multi-region replication, and ECS task execution role permissions for secrets injection.
Estimated Time:2m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic