Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is writing an AWS CloudFormation template to deploy a web application. The application requires two configurations:
1. A database connection password that must be rotated automatically every 30 days.
2. A database connection port number, which is a non-sensitive configuration parameter.

To optimize operational efficiency, security, and cost, how should the developer store and reference these configurations in the CloudFormation template?

  1. A
    Store both the database password and the port number in AWS Secrets Manager, and reference both in the template using Secrets Manager dynamic references.
  2. B
    Store the database password in Systems Manager Parameter Store as a SecureString parameter with automatic rotation enabled, and store the port number in AWS Secrets Manager.
  3. Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.Answer
  4. D
    Store the database password as a standard CloudFormation Parameter with NoEcho set to true, and manually update the stack parameters whenever the password is rotated.

Answer

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.
The correct approach is to store the sensitive database password in AWS Secrets Manager because it supports native automatic rotation every 30 days. To optimize costs, the non-sensitive port number should be stored in Systems Manager Parameter Store as it is free for standard parameters. Both can be securely referenced in the CloudFormation template using dynamic references without exposing plaintext values.

Step-by-Step Solution

1
Analyze the security and rotation requirements for the database password.
Identify that AWS Secrets Manager is required because it natively supports automatic rotation (every 30 days) and secure storage of sensitive credentials.
To meet the security and compliance requirement of automated rotation.
2
Analyze the requirements for the database port number.
Identify that the port number is non-sensitive and does not require rotation or high-cost storage, making AWS Systems Manager Parameter Store the most cost-effective service.
To optimize costs and distinguish between sensitive and non-sensitive configurations.
3
Determine how to reference both configurations in the CloudFormation template securely.
Use CloudFormation dynamic references to retrieve the values at runtime without hardcoding them in the template.
To maintain infrastructure-as-code best practices and avoid credential exposure in version control.

Key Concept

AWS CloudFormation Dynamic References
Rate this question

Topics

AWS CloudFormation

More questions from this topic