Examkin

Question

Difficulty: EasyAWS CloudFormation

A developer is designing an AWS CloudFormation template to deploy an application that connects to an Amazon RDS database. The developer needs to store the database credentials securely and prevent the database from being accidentally deleted if the CloudFormation stack is deleted or updated. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and retrieve them in the template using dynamic references.Answer
  2. Configure the DeletionPolicy attribute with a value of Retain on the database resource in the template.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a standard String parameter type to optimize costs.
  4. D
    Manually update the database password directly in the Amazon RDS console after the stack deployment is complete.
  5. E
    Trigger a stack update to apply the deletion policy while the stack is currently in the UPDATE_ROLLBACK_IN_PROGRESS state.

Answer

To securely manage the credentials and protect the database, the developer should store the database credentials in AWS Secrets Manager and retrieve them using dynamic references, and also configure the DeletionPolicy attribute with a value of Retain on the RDS database resource in the template.
Storing credentials in AWS Secrets Manager and referencing them using dynamic references keeps sensitive values encrypted and out of the template code. Setting the DeletionPolicy to Retain on the RDS resource prevents CloudFormation from deleting the database when the stack is deleted or the resource is updated out of the stack.

Step-by-Step Solution

1
Select a secure storage mechanism for the database credentials.
Determine that AWS Secrets Manager is the correct service for storing database credentials, and referencing it via CloudFormation dynamic references keeps them secure.
Hardcoding secrets or using unencrypted parameter types exposes sensitive information, violating security best practices.
2
Select a policy to prevent accidental resource deletion.
Determine that the DeletionPolicy attribute should be set to Retain on the RDS resource definition.
The Retain policy ensures that CloudFormation keeps the physical resource even if its stack is deleted or if the resource is removed during a stack update.
3
Eliminate incorrect options based on common AWS misconfigurations.
Discard options suggesting plaintext Parameter Store parameters, out-of-band console changes (which cause drift), or updating a stack that is currently in a rollback state.
These choices introduce security vulnerabilities, drift issues, or violate CloudFormation state machine rules.

Key Concept

AWS CloudFormation Resource Lifecycle and Credential Management
Rate this question

Topics

AWS CloudFormation

More questions from this topic