Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is deploying a microservices application to AWS App Runner. The application needs to retrieve two configuration settings:

1. Database credentials for an Amazon Aurora PostgreSQL database that must be rotated automatically every 30 days.
2. A public API endpoint URL for an external service that is non-sensitive and frequently accessed.

Which combination of actions should the developer perform to manage and retrieve these configurations securely and cost-effectively? (Select TWO.)

  1. A
    Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter and enable native scheduled rotation.
  2. B
    Store the external service endpoint URL in AWS Secrets Manager to keep all external references in a single service.
  3. Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function.Answer
  4. Store the external service endpoint URL in AWS Systems Manager Parameter Store as a String parameter.Answer
  5. E
    Embed the database credentials directly in the application code as environment variables within the Dockerfile.

Answer

The developer should store the database credentials in AWS Secrets Manager and configure automatic rotation, and store the non-sensitive external service endpoint URL in AWS Systems Manager Parameter Store as a String parameter.
AWS Secrets Manager is designed for storing database credentials securely and provides native support for RDS/Aurora automatic rotation via Lambda. AWS Systems Manager Parameter Store is the most cost-effective storage for non-sensitive configuration data like API endpoints, as standard parameters are free.

Step-by-Step Solution

1
Determine the appropriate storage service for the database credentials.
Identify AWS Secrets Manager as the best choice because it offers native integration with Amazon Aurora and built-in automatic credential rotation.
AWS Secrets Manager is specifically built for secrets requiring lifecycle management and rotation, reducing custom scripting effort.
2
Determine the appropriate storage service for the public API endpoint URL.
Identify AWS Systems Manager Parameter Store as the correct choice since the configuration is non-sensitive and does not require rotation.
Parameter Store standard parameters are free and ideal for non-sensitive application settings, optimizing costs.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on security features (like automatic rotation) and cost-efficiency.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic