Secrets Management and Parameter Store

45 questions

All types45 Multiple choice21 Multiple select24

A company runs a logistics tracking service on AWS Fargate. The application needs to retrieve a sensitive API key for a third-party shipping service dynamically at runtime. The API key is managed by a separate security team in a dedicated AWS account, where it must be rotated every 90 days. The Fargate tasks in the application account must access this key securely. To implement this configuration, which two steps should be performed? (Select TWO.)

Select all that apply

Create a secret in AWS Secrets Manager within the security account, and apply a resource-based policy to allow retrieval from the application account's Fargate task roles.

Configure an AWS Lambda function in the security account to handle the API key rotation, and associate it with the Secrets Manager secret on a 90-day schedule.

Create a Parameter Store parameter of type SecureString in the security account, and apply a resource-based policy to grant access to the application account's Fargate tasks.

Create a secret in AWS Secrets Manager within the security account, and attach the read permissions to the Fargate task execution roles in the application account.

Define the API key as a plaintext parameter in Systems Manager Parameter Store, and hardcode the security account's IAM access keys in the application's SDK client constructor.

Show answer & explanation

Answer: Create a secret in AWS Secrets Manager within the security account, and apply a resource-based policy to allow retrieval from the application account's Fargate task roles.; Configure an AWS Lambda function in the security account to handle the API key rotation, and associate it with the Secrets Manager secret on a 90-day schedule.

Answer

To securely share and rotate the key across accounts, the developer must use AWS Secrets Manager in the security account with a resource-based policy permitting access to the application's Fargate task roles, and configure a custom AWS Lambda function to perform the 90-day rotation.

To support both cross-account access and automated rotation, AWS Secrets Manager is the correct service choice. A resource-based policy attached directly to the secret allows the application's Fargate task roles in a separate account to read the secret directly. Additionally, Secrets Manager integrates with AWS Lambda to orchestrate the rotation logic on a schedule.

Step-by-Step Solution

Select the proper service for cross-account access and rotation.

AWS Secrets Manager is chosen instead of Systems Manager Parameter Store.

Secrets Manager natively supports resource-based policies for cross-account access and has built-in rotation functionality, whereas Parameter Store parameters do not support resource-based policies.

Configure permissions for the Fargate tasks.

Attach a resource-based policy to the Secrets Manager secret allowing the Fargate task roles to retrieve it.

Dynamic runtime API calls by application code require permissions attached to the task role itself, not the task execution role.

Implement the automatic rotation.

Create a Lambda function to perform rotation and set the rotation schedule on the secret to 90 days.

AWS Secrets Manager uses a Lambda function to execute rotation workflows automatically.

Key Concept

Cross-account access and automatic rotation of sensitive credentials using AWS Secrets Manager, and distinguishing between Fargate task roles and task execution roles.

Question 42Question →

A developer is deploying a web application to Amazon EC2 instances. The application requires access to a sensitive API key for a third-party marketing platform. The company's security policy mandates that the API key must be encrypted at rest and rotated every 90 days. The developer wants to implement a solution that supports automatic rotation with minimal custom code. Which service and configuration should the developer choose to store and manage the API key?

Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter. Enable the built-in Parameter Store automatic rotation feature and set the rotation interval to 90 days.

Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.

Store the API key in AWS Systems Manager Parameter Store as a String parameter. Use a customer managed key in AWS KMS to encrypt the parameter, and write a cron job on the EC2 instances to update the parameter every 90 days.

Store the API key as an environment variable in the EC2 instance launch template. Use an AWS SDK client within the application code to retrieve the value from the instance metadata service.

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.

Answer

Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.

Storing the API key in AWS Secrets Manager and using a custom AWS Lambda function for rotation is the correct approach. Secrets Manager natively supports automatic rotation of secrets using Lambda functions. Since this is a third-party API key, a custom Lambda function is required to perform the rotation steps, meeting the 90-day rotation requirement with minimal custom code.

Step-by-Step Solution

Evaluate the security and rotation requirements for the sensitive API key.

Identify that the API key must be encrypted at rest and automatically rotated every 90 days.

Establishing these requirements guides the selection of the correct AWS service that supports automatic secret rotation.

Compare AWS Secrets Manager and Systems Manager Parameter Store capabilities.

AWS Secrets Manager is selected because it provides built-in rotation functionality via integration with AWS Lambda, whereas Parameter Store does not support native automatic rotation.

Secrets Manager is designed specifically for managing secrets that require automatic rotation, while Parameter Store is suited for configuration management.

Configure the rotation mechanism for the non-AWS resource (third-party API).

A custom AWS Lambda function is configured to handle the specific rotation logic for the third-party marketing platform, and the rotation schedule is set to 90 days on the Secrets Manager secret.

For non-RDS and third-party services, Secrets Manager uses a Lambda function to perform the steps required to rotate the credentials.

Key Concept

AWS Secrets Manager vs. AWS Systems Manager Parameter Store for secrets rotation

Estimated Time:1m 30s

Question 43Question →

A developer is configuring a microservices application running on Amazon Elastic Kubernetes Service (Amazon EKS). The application needs to retrieve database credentials to connect to an Amazon RDS for Microsoft SQL Server database. The company's security policy requires that these credentials be encrypted at rest and automatically rotated every 30 days without manual intervention or application redeployment. Which TWO steps should the developer perform to meet these requirements securely? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager.

Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter.

Configure an Amazon EventBridge scheduled rule to trigger a custom script that rotates the database password and updates the parameter in Systems Manager Parameter Store.

Hardcode the database credentials within the application's codebase and decrypt them at runtime using the AWS SDK and a customer managed key in AWS KMS.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager.; Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Answer

Store the database credentials in AWS Secrets Manager and configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Storing the database credentials in AWS Secrets Manager is correct because Secrets Manager is designed for storing sensitive data like database credentials and supports automatic rotation natively. Configuring Secrets Manager to use an AWS Lambda rotation function to update the database credentials every 30 days fulfills the rotation requirement with minimal operational overhead, since AWS provides pre-built Lambda templates for RDS database credential rotation.

Step-by-Step Solution

Select the appropriate credential storage service.

Choose AWS Secrets Manager over Systems Manager Parameter Store because only Secrets Manager natively supports managed automatic rotation.

Parameter Store does not have native automatic rotation features, which makes Secrets Manager the correct choice for credential rotation requirements.

Configure the secret rotation mechanism.

Associate the secret with a Lambda rotation function that updates both the database and the Secrets Manager secret value.

AWS Secrets Manager uses a Lambda function to perform the steps required to securely rotate database credentials on a schedule.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for credentials requiring rotation

Estimated Time:1m 30s

Question 44Question →

An enterprise web application running on Amazon EC2 instances needs to authenticate with an Amazon RDS for PostgreSQL database. The database password must be rotated every 30 days to comply with security requirements. The developer wants to implement a secure solution that automates the rotation process with the least operational overhead. Which approach should the developer take to meet these requirements?

Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.

Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store. Enable built-in automatic rotation in the Parameter Store settings for RDS and configure a rotation interval of 30 days.

Store the database credentials in a secure configuration file packaged with the application. Initialize the AWS SDK client inside the application by hardcoding temporary IAM user access keys that have permission to read the configuration file.

Store the database password as a standard String parameter in AWS Systems Manager Parameter Store. Use a local cron job on the EC2 instances to retrieve the parameter using hardcoded AWS access keys and rotate the password in the database.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.

Answer

AWS Secrets Manager natively supports automatic rotation of database credentials, including built-in templates for Amazon RDS databases. By enabling rotation and selecting the target RDS database, Secrets Manager automatically updates the database password and the secret value at the specified interval using a managed Lambda function. The application can query Secrets Manager via the AWS SDK at runtime using IAM roles, ensuring it always uses the current credentials without requiring code changes or redeployments.

Step-by-Step Solution

Identify the security requirements: password rotation every 30 days, minimal operational overhead, and secure runtime access by the application.

Recognize that database credential rotation is natively supported by AWS Secrets Manager for Amazon RDS databases, whereas Parameter Store lacks native database rotation integration.

Choosing the service with native rotation integration minimizes custom script maintenance and operational overhead.

Evaluate the credential retrieval method from the application running on EC2.

Ensure the application retrieves the database password dynamically at runtime using the AWS SDK, authenticated via temporary credentials from an IAM instance profile.

Dynamic retrieval ensures the application uses the latest password post-rotation, and IAM instance profiles avoid the security risk of hardcoding AWS access keys.

Key Concept

AWS Secrets Manager native RDS rotation vs Systems Manager Parameter Store configuration

Estimated Time:1m 30s

Question 45Question →

A developer is building an AWS Lambda function that integrates with an external customer relationship management (CRM) platform. The integration requires a client secret that must be stored securely and rotated automatically every 30 days. Which solution meets these requirements with the least operational overhead?

Hardcode the client secret in the Lambda function's source code, and use a customer managed key in AWS Key Management Service (AWS KMS) to encrypt the function deployment package.

Store the client secret in AWS Secrets Manager. Configure automatic rotation for the secret by defining a rotation schedule of 30 days and using an AWS Lambda function to perform the rotation.

Store the client secret in AWS Systems Manager Parameter Store as a SecureString parameter. Set up an Amazon EventBridge scheduled rule to trigger a custom AWS Lambda function that updates the parameter value every 30 days.

Store the client secret in AWS Systems Manager Parameter Store as a String parameter, and reference the parameter value directly in the Lambda function's environment variables.

Show answer & explanation

Answer: Store the client secret in AWS Secrets Manager. Configure automatic rotation for the secret by defining a rotation schedule of 30 days and using an AWS Lambda function to perform the rotation.

Answer

Store the client secret in AWS Secrets Manager, and configure automatic rotation for the secret using a 30-day schedule and an AWS Lambda function to execute the rotation.

AWS Secrets Manager is the optimal service for storing sensitive API keys and secrets that require automatic rotation. It features built-in support for rotating secrets on a defined schedule using a Lambda function. This native integration reduces administrative overhead compared to building custom rotation tools.

Step-by-Step Solution

Evaluate the security and rotation requirements for the sensitive CRM client secret.

Identify that the secret must be encrypted and must support automated rotation every 30 days with minimal operational overhead.

This establishes the criteria for selecting between AWS Secrets Manager and Systems Manager Parameter Store.

Compare AWS Secrets Manager and AWS Systems Manager Parameter Store features.

Determine that while Parameter Store supports SecureString parameters, it does not offer built-in rotation functionality. Secrets Manager natively supports automatic rotation via Lambda on a schedule.

This eliminates Parameter Store options due to the lack of built-in rotation capabilities.

Select the correct option based on security best practices.

Store the secret in Secrets Manager and configure automatic rotation.

This fulfills all requirements with the least operational effort.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store rotation capabilities

PreviousPage 3 / 3

Secrets Management and Parameter Store

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes