Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is configuring a machine learning pipeline in Amazon SageMaker. The pipeline needs to retrieve a personal access token (PAT) to pull training code from a private Git repository. This PAT must be rotated monthly and accessed by pipelines running across multiple AWS accounts in the same organization. Additionally, the pipeline needs to retrieve non-sensitive training hyperparameters (such as learning rate and batch size) that are only used within the local AWS account. How should the developer store these values to meet the requirements securely and cost-effectively?

  1. Store the private Git repository token in AWS Secrets Manager and attach a resource-based policy to the secret to allow cross-account access. Store the hyperparameters as String parameters in AWS Systems Manager Parameter Store.Answer
  2. B
    Store the private Git repository token as a SecureString parameter in AWS Systems Manager Parameter Store and attach a resource-based policy to the parameter to allow cross-account access. Store the hyperparameters in AWS Secrets Manager.
  3. C
    Hardcode the private Git repository token directly in the SageMaker pipeline's script, and store the hyperparameters as String parameters in AWS Systems Manager Parameter Store.
  4. D
    Store both the private Git repository token and the hyperparameters in AWS Secrets Manager, enabling automatic rotation for both to centralize secret management.

Answer

Store the private Git repository token in AWS Secrets Manager and attach a resource-based policy to the secret to allow cross-account access. Store the hyperparameters as String parameters in AWS Systems Manager Parameter Store.
The correct answer correctly identifies that AWS Secrets Manager should be used for the private Git repository token because it natively supports resource-based policies for cross-account sharing and automatic rotation. It also correctly identifies that Systems Manager Parameter Store is the most cost-effective service for storing non-sensitive hyperparameters, avoiding unnecessary Secrets Manager costs.

Step-by-Step Solution

1
Analyze the requirements for the private Git repository token.
Identify that the token is sensitive, needs automatic monthly rotation, and requires cross-account access.
This determines the best security service to use based on features like resource-based policies and rotation.
2
Analyze the requirements for the hyperparameters.
Identify that the hyperparameters are non-sensitive configuration data, do not require rotation, and are only accessed locally.
This helps select the most cost-effective storage option for non-sensitive configurations.
3
Compare AWS Secrets Manager and Systems Manager Parameter Store features and cost.
AWS Secrets Manager is selected for the token because it supports resource-based policies for cross-account access and automatic rotation. Systems Manager Parameter Store is selected for the hyperparameters because standard parameters are free and suitable for non-sensitive data.
Ensures the solution is both secure and optimized for cost.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation, cross-account access, and cost-efficiency.
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic