Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is deploying a Python application to AWS Elastic Beanstalk. The application needs to retrieve two values: a connection string password for a self-hosted PostgreSQL database running on an Amazon EC2 instance (which must be rotated every 45 days), and a payment gateway API endpoint URL (which is non-sensitive and static). To meet these requirements with the lowest cost and operational effort, which two configuration steps should the developer perform? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and configure an AWS Lambda function to rotate the database credential on a 45-day schedule.Answer
  2. Store the payment gateway API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.Answer
  3. C
    Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter and enable the built-in Parameter Store auto-rotation feature.
  4. D
    Hardcode the database password in the application code and use the AWS SDK to decrypt the value during the EC2 instance initialization.
  5. E
    Store both the database password and the payment gateway API endpoint URL in AWS Secrets Manager to centralize credentials and configurations.

Answer

Store the database password in AWS Secrets Manager with a Lambda rotation function, and store the non-sensitive payment gateway URL in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive data like database passwords and supports automatic rotation using AWS Lambda. On the other hand, Systems Manager Parameter Store is a cost-effective service for storing non-sensitive configuration data such as API endpoint URLs, which do not change frequently and do not require rotation.

Step-by-Step Solution

1
Analyze the security and rotation requirements for the database password.
The password is a sensitive credential and must be rotated automatically every 45 days. AWS Secrets Manager is the appropriate service because it supports automatic rotation schedules and integration with Lambda for rotating self-hosted databases.
Parameter Store does not natively support automatic rotation schedules.
2
Analyze the storage requirements for the payment gateway API endpoint URL.
The URL is non-sensitive and static. AWS Systems Manager Parameter Store is the most cost-effective and appropriate service for storing simple, non-sensitive configuration data.
Secrets Manager is more expensive and unnecessary for non-sensitive data.
3
Combine the decisions into the correct configuration steps.
Store the database password in Secrets Manager with Lambda rotation, and store the API URL in Parameter Store.
This combination ensures security compliance for the password and cost-efficiency for the configuration data.

Key Concept

Differentiating between AWS Secrets Manager and Systems Manager Parameter Store based on secrets rotation requirements and cost-efficiency.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic