Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is designing a serverless backend using AWS Lambda that connects to an Amazon RDS for PostgreSQL database. The application security policy requires that database passwords be rotated automatically every 30 days. Additionally, the Lambda function needs to retrieve non-sensitive configuration parameters, such as logging levels and external API endpoints. Which combination of actions should the developer take to implement these requirements securely and cost-effectively? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure the built-in automatic rotation for Amazon RDS.Answer
  2. Store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as Standard parameters.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as SecureString parameters and configure built-in automatic rotation.
  4. D
    Hardcode the database credentials directly within the Lambda function's handler initialization code to avoid API latency.
  5. E
    Store the non-sensitive configuration parameters in AWS Secrets Manager to centralize all secrets and configurations.

Answer

Storing the database credentials in AWS Secrets Manager with built-in automatic rotation enabled, and storing the non-sensitive configurations in AWS Systems Manager Parameter Store as Standard parameters.
AWS Secrets Manager is designed for managing secrets such as database credentials and supports automated rotation out of the box, specifically with integrations for Amazon RDS. AWS Systems Manager Parameter Store is ideal for general, non-sensitive configuration parameters because Standard parameters are free, making it the most cost-effective choice for configurations that do not require rotation or encryption.

Step-by-Step Solution

1
Identify the storage and rotation requirements for the database credentials.
Database credentials are sensitive and require automatic rotation every 30 days. AWS Secrets Manager is the optimal service because it provides built-in rotation integration with Amazon RDS.
Parameter Store does not natively support automatic rotation, so using Parameter Store would require writing custom rotation logic.
2
Identify the storage and cost requirements for non-sensitive configurations.
Non-sensitive configurations (like logging levels) do not require rotation or encryption. Storing them in Parameter Store as Standard parameters is free and meets the cost-effectiveness requirement.
Storing non-sensitive config in Secrets Manager would incur unnecessary monthly costs per secret.

Key Concept

Distinguishing between AWS Secrets Manager and AWS Systems Manager Parameter Store features and cost profiles.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic