Examkin

Question

Difficulty: MediumAWS CloudFormation

A software engineering team is using AWS CloudFormation to deploy a three-tier web application. The application requires a database password that must be rotated automatically every 30 days. Which approach should the developer use to securely reference the database password in the CloudFormation template?

  1. A
    Retrieve the password using a dynamic reference to an AWS Systems Manager Parameter Store SecureString parameter.
  2. B
    Define the database password in a template Parameter with the NoEcho property set to true, and manually update the EC2 instance database configurations out-of-band when the password rotates.
  3. Retrieve the password using a dynamic reference to AWS Secrets Manager directly within the resource properties in the template.Answer
  4. D
    Define the database password as a standard parameter, and if a stack update fails during rotation, manually delete the database instance to force the stack to continue rollback.

Answer

Retrieve the password using a dynamic reference to AWS Secrets Manager directly within the resource properties in the template.
Using a dynamic reference to AWS Secrets Manager is the recommended best practice for referencing sensitive data that changes dynamically, such as database credentials that rotate every 30 days. AWS Secrets Manager natively integrates with AWS Lambda to rotate credentials automatically and integrates with CloudFormation templates via dynamic references, preventing plaintext passwords from appearing in the template or stack configuration.

Step-by-Step Solution

1
Identify the requirement for automatic rotation of the database password.
AWS Secrets Manager is identified as the service that natively supports automatic rotation (using AWS Lambda) and integration with CloudFormation.
Systems Manager Parameter Store does not support native rotation schedules for secrets.
2
Determine the secure method to fetch the secret in CloudFormation.
Dynamic references using the 'resolve:secretsmanager' pattern are chosen.
This avoids hardcoding or passing parameters that could be exposed in console logs or template history.
3
Ensure the template avoids manual drift.
Using dynamic references allows CloudFormation to resolve the latest secret value dynamically during deployment operations without requiring manual resource modifications.
Out-of-band updates violate infrastructure-as-code principles.

Key Concept

Using AWS Secrets Manager dynamic references in AWS CloudFormation to secure and automatically rotate database credentials without introducing stack drift.
Rate this question

Topics

AWS CloudFormation

More questions from this topic