Examkin

Question

Difficulty: MediumSecrets Management and Parameter Store

A developer is configuring a microservices application running on Amazon Elastic Kubernetes Service (Amazon EKS). The application needs to retrieve database credentials to connect to an Amazon RDS for Microsoft SQL Server database. The company's security policy requires that these credentials be encrypted at rest and automatically rotated every 30 days without manual intervention or application redeployment. Which TWO steps should the developer perform to meet these requirements securely? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager.Answer
  2. Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter.
  4. D
    Configure an Amazon EventBridge scheduled rule to trigger a custom script that rotates the database password and updates the parameter in Systems Manager Parameter Store.
  5. E
    Hardcode the database credentials within the application's codebase and decrypt them at runtime using the AWS SDK and a customer managed key in AWS KMS.

Answer

Store the database credentials in AWS Secrets Manager and configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.
Storing the database credentials in AWS Secrets Manager is correct because Secrets Manager is designed for storing sensitive data like database credentials and supports automatic rotation natively. Configuring Secrets Manager to use an AWS Lambda rotation function to update the database credentials every 30 days fulfills the rotation requirement with minimal operational overhead, since AWS provides pre-built Lambda templates for RDS database credential rotation.

Step-by-Step Solution

1
Select the appropriate credential storage service.
Choose AWS Secrets Manager over Systems Manager Parameter Store because only Secrets Manager natively supports managed automatic rotation.
Parameter Store does not have native automatic rotation features, which makes Secrets Manager the correct choice for credential rotation requirements.
2
Configure the secret rotation mechanism.
Associate the secret with a Lambda rotation function that updates both the database and the Secrets Manager secret value.
AWS Secrets Manager uses a Lambda function to perform the steps required to securely rotate database credentials on a schedule.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for credentials requiring rotation
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic