Examkin

Question

Difficulty: EasyAWS CloudFormation

A developer is configuring an AWS CloudFormation template to deploy an Amazon RDS DB instance. The database requires a master password that must be stored securely and rotated automatically every 30 days to comply with company security policies. Which configuration should the developer use to reference and manage the password?

  1. A
    Store the database password in Systems Manager Parameter Store as a SecureString parameter, and reference it using the ssm-secure dynamic reference in the template.
  2. Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.Answer
  3. C
    Store the database password in Systems Manager Parameter Store as a String parameter, and reference it using the ssm dynamic reference in the template.
  4. D
    Hardcode the password in the CloudFormation template, and then manually change it in the Amazon RDS console after deployment to trigger a stack drift detection and alignment.

Answer

Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.
The correct option stores the database password in AWS Secrets Manager, which natively supports automatic rotation, and references it using the secretsmanager dynamic reference in the template. This ensures that the secret is kept secure and is retrieved dynamically during deployment.

Step-by-Step Solution

1
Analyze the requirements: secure storage of a database password and support for automatic rotation.
Identify that AWS Secrets Manager is the appropriate service for credentials requiring automatic rotation, whereas Systems Manager Parameter Store does not support native rotation.
Choosing the correct AWS service ensures security compliance and automation features are utilized.
2
Determine how to reference the secret in the CloudFormation template.
Identify that the secretsmanager dynamic reference should be used.
Dynamic references retrieve sensitive information at deployment time without storing it in plaintext or parameters.

Key Concept

AWS CloudFormation Dynamic References and Secrets Management
Rate this question

Topics

AWS CloudFormation

More questions from this topic