Examkin

Question

Difficulty: MediumAWS Serverless Application Model (SAM)

A developer is configuring an AWS Serverless Application Model (SAM) template for a microservice. The microservice includes an `AWS::Serverless::Function` that requires access to a database password. The password must be rotated automatically every 30 days to comply with corporate security standards.

Which approach should the developer use to securely provide the database password to the function through the SAM template?

  1. A
    Reference the password in the function's environment variables using an AWS Systems Manager Parameter Store SecureString dynamic reference.
  2. B
    Store the password in a local configuration file and omit the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template to prevent SAM from parsing it.
  3. Reference the password in the function's environment variables using an AWS Secrets Manager dynamic reference.Answer
  4. D
    Configure the function's execution role with an IAM trust policy that allows the database service principal to inject the password during execution.

Answer

Reference the password in the function's environment variables using an AWS Secrets Manager dynamic reference.
The correct approach is to reference the password using an AWS Secrets Manager dynamic reference. AWS Secrets Manager is designed to store sensitive data such as database credentials and supports automated rotation out of the box. By using a dynamic reference in the environment variables of the function, the SAM deployment safely retrieves the value during stack operations.

Step-by-Step Solution

1
Identify the rotation requirement for the credential.
Since the password must be rotated every 30 days, AWS Secrets Manager is the correct destination because it offers native, automated secret rotation, whereas Systems Manager Parameter Store does not.
Choosing the correct credential store satisfies the rotation compliance rule.
2
Identify how to retrieve the credential in the template.
Utilize a dynamic reference `{{resolve:secretsmanager:secret-id}}` inside the environment variable declaration of the AWS::Serverless::Function resource.
This allows the template to fetch the current value of the secret at runtime or deployment without hardcoding it.
3
Verify template compilation requirements.
Retain the root-level `Transform: AWS::Serverless-2016-10-31` header so that the AWS SAM template is transformed into standard CloudFormation resources successfully.
Omitting the Transform header causes CloudFormation to reject serverless resources like AWS::Serverless::Function.

Key Concept

AWS SAM integration with AWS Secrets Manager dynamic references for automated credential management.
Estimated Time:1m 30s
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic