Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is deploying a containerized application to Amazon Elastic Kubernetes Service (Amazon EKS). The application requires access to a database password for an Amazon RDS DB instance and an API key for a third-party service. The database password must be rotated every 30 days. The third-party API key changes infrequently, and the developer wants to access it with minimum latency and cost. Which combination of steps should the developer take to retrieve these configurations securely and cost-effectively? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.Answer
  2. Store the third-party API key as a SecureString parameter in AWS Systems Manager Parameter Store and retrieve it via the application.Answer
  3. C
    Store the database password in Systems Manager Parameter Store and enable native Parameter Store automatic rotation.
  4. D
    Store the third-party API key in AWS Secrets Manager to leverage its built-in rotation and access rate capabilities.
  5. E
    Hardcode the database password and the API key directly into the Kubernetes deployment manifest file as environment variables.

Answer

Store the database password in AWS Secrets Manager with Lambda rotation, and store the third-party API key as a SecureString parameter in AWS Systems Manager Parameter Store.
The correct combination involves storing the database password in AWS Secrets Manager because it natively supports automatic rotation via Lambda, and storing the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter because standard parameters are free and ideal for infrequently changing secrets.

Step-by-Step Solution

1
Analyze requirements for the database password.
The database password requires automatic rotation every 30 days. AWS Secrets Manager natively supports automatic rotation (using an AWS Lambda function) and is the correct choice.
Parameter Store does not support automated secret rotation natively.
2
Analyze requirements for the third-party API key.
The API key changes infrequently, does not require automated rotation, and must be accessed with minimal cost. AWS Systems Manager Parameter Store (specifically standard SecureString parameters) is free of charge and provides low latency.
Using Secrets Manager for this key would incur unnecessary monthly fees.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on rotation, cost, and lifecycle requirements.
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic