Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A company runs a logistics tracking service on AWS Fargate. The application needs to retrieve a sensitive API key for a third-party shipping service dynamically at runtime. The API key is managed by a separate security team in a dedicated AWS account, where it must be rotated every 90 days. The Fargate tasks in the application account must access this key securely. To implement this configuration, which two steps should be performed? (Select TWO.)

  1. Create a secret in AWS Secrets Manager within the security account, and apply a resource-based policy to allow retrieval from the application account's Fargate task roles.Answer
  2. Configure an AWS Lambda function in the security account to handle the API key rotation, and associate it with the Secrets Manager secret on a 90-day schedule.Answer
  3. C
    Create a Parameter Store parameter of type SecureString in the security account, and apply a resource-based policy to grant access to the application account's Fargate tasks.
  4. D
    Create a secret in AWS Secrets Manager within the security account, and attach the read permissions to the Fargate task execution roles in the application account.
  5. E
    Define the API key as a plaintext parameter in Systems Manager Parameter Store, and hardcode the security account's IAM access keys in the application's SDK client constructor.

Answer

To securely share and rotate the key across accounts, the developer must use AWS Secrets Manager in the security account with a resource-based policy permitting access to the application's Fargate task roles, and configure a custom AWS Lambda function to perform the 90-day rotation.
To support both cross-account access and automated rotation, AWS Secrets Manager is the correct service choice. A resource-based policy attached directly to the secret allows the application's Fargate task roles in a separate account to read the secret directly. Additionally, Secrets Manager integrates with AWS Lambda to orchestrate the rotation logic on a schedule.

Step-by-Step Solution

1
Select the proper service for cross-account access and rotation.
AWS Secrets Manager is chosen instead of Systems Manager Parameter Store.
Secrets Manager natively supports resource-based policies for cross-account access and has built-in rotation functionality, whereas Parameter Store parameters do not support resource-based policies.
2
Configure permissions for the Fargate tasks.
Attach a resource-based policy to the Secrets Manager secret allowing the Fargate task roles to retrieve it.
Dynamic runtime API calls by application code require permissions attached to the task role itself, not the task execution role.
3
Implement the automatic rotation.
Create a Lambda function to perform rotation and set the rotation schedule on the secret to 90 days.
AWS Secrets Manager uses a Lambda function to execute rotation workflows automatically.

Key Concept

Cross-account access and automatic rotation of sensitive credentials using AWS Secrets Manager, and distinguishing between Fargate task roles and task execution roles.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic