Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is deploying a database-backed web application using an AWS CloudFormation template. The application requires a database password that must be automatically rotated every 30 days, and a database port setting that is non-sensitive and static. Which of the following approaches represent best practices for managing these configurations? (Select TWO.)

  1. Store the database password in AWS Secrets Manager, enable automatic rotation, and retrieve the password in the CloudFormation template using a dynamic reference.Answer
  2. Store the database port in AWS Systems Manager Parameter Store as a standard parameter, and retrieve it in the CloudFormation template using a dynamic reference.Answer
  3. C
    Store the database port in AWS Secrets Manager as a secret to consolidate all database configuration parameters in one location.
  4. D
    Store the database password in AWS Systems Manager Parameter Store and configure Parameter Store to automatically rotate the password every 30 days.
  5. E
    Manually update the database password directly on the Amazon RDS instance using the AWS Console, and perform a stack update with the new password.

Answer

Store the database password in AWS Secrets Manager with automatic rotation, and store the database port in AWS Systems Manager Parameter Store, referencing both via dynamic references.
The correct approach is to store the database password in AWS Secrets Manager because it is sensitive and requires automatic rotation, and store the database port in AWS Systems Manager Parameter Store because it is static and non-sensitive. Both values should be retrieved using dynamic references in the CloudFormation template to avoid hardcoding sensitive data and to ensure secure, automated retrieval at deployment time.

Step-by-Step Solution

1
Determine the security and lifecycle needs of each configuration item.
The database password is sensitive and requires automatic rotation; the database port is non-sensitive and static.
Identifying these traits ensures that resources are configured using the most secure and cost-efficient AWS services.
2
Select the correct storage service for the sensitive password.
AWS Secrets Manager is selected.
Secrets Manager natively supports automatic rotation and secure encryption, which are required for the database password.
3
Select the correct storage service for the non-sensitive port.
AWS Systems Manager Parameter Store is selected.
Parameter Store standard parameters are free and ideal for static, non-sensitive parameters, avoiding the cost of Secrets Manager.
4
Reference both values dynamically inside the CloudFormation template.
Dynamic references are added to the template parameters.
Dynamic references allow the stack to fetch the values at deploy time without storing sensitive data in the template definition.

Key Concept

AWS CloudFormation templates should integrate with AWS Systems Manager Parameter Store and AWS Secrets Manager using dynamic references to securely and cost-effectively inject parameters based on their sensitivity and rotation requirements.
Rate this question

Topics

AWS CloudFormation

More questions from this topic