Examkin

Question

Difficulty: EasySecrets Management and Parameter Store

A developer is configuring an application running on AWS Elastic Beanstalk that requires access to a database. The database password must be rotated automatically every 30 days. Which solution should the developer implement to meet these security requirements?

  1. Store the database password in AWS Secrets Manager and enable the built-in automatic rotation feature.Answer
  2. B
    Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store and configure a lifecycle policy to automate rotation.
  3. C
    Hardcode the database password directly within the application initialization code and configure a cron job to redeploy the app with a new password.
  4. D
    Store the database password in an encrypted Amazon S3 bucket and use a custom script in the application to download and decrypt it.

Answer

Store the database password in AWS Secrets Manager and enable the built-in automatic rotation feature.
AWS Secrets Manager natively supports automatic rotation of database credentials using built-in templates, satisfying the security requirements with minimal effort.

Step-by-Step Solution

1
Analyze the requirement to store database credentials securely with automatic rotation every 30 days.
Automatic rotation of credentials is a primary capability of AWS Secrets Manager.
Choosing a service that natively supports automatic rotation avoids custom code.
2
Evaluate and eliminate options that do not support automatic rotation natively.
AWS Systems Manager Parameter Store and Amazon S3 do not support native automatic rotation.
Eliminating options with high operational overhead narrows down the correct service.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for automatic secrets rotation
Estimated Time:45s
Rate this question

Topics

Secrets Management and Parameter Store

More questions from this topic