Examkin

Question

Difficulty: HardSecrets and Parameter Management

An enterprise application hosted on Amazon ECS tasks in a private VPC must connect to a legacy PostgreSQL database hosted on-premises via an AWS Direct Connect connection. The database credentials must be rotated every 30 days to comply with security regulations. The rotation process must be automated, secure at rest, and must not require changes to the application deployment pipeline. Which database credential management solution meets these security requirements with the least operational overhead?

  1. Store the database credentials in AWS Secrets Manager. Configure a 30-day rotation schedule for the secret and deploy a custom AWS Lambda function within the VPC to update the credentials on both the PostgreSQL database and the Secrets Manager secret.Answer
  2. B
    Store the database credentials as a String parameter in AWS Systems Manager Parameter Store. Configure an Amazon EventBridge rule that triggers an AWS Lambda function every 30 days to rotate the database password and update the parameter value.
  3. C
    Store the database credentials in AWS Secrets Manager encrypted with an AWS KMS Customer Managed Key (CMK). Enable automatic annual rotation on the CMK and set the rotation window to 30 days to automatically rotate the database password.
  4. D
    Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Rely on the automatic rotation feature of the associated AWS KMS Customer Managed Key (CMK) to automatically regenerate the credential value and rotate it on the on-premises database every 30 days.

Answer

Store the database credentials in AWS Secrets Manager, configuring a 30-day rotation schedule along with a custom AWS Lambda function in the VPC to update the credentials in both the database and the secret.
The correct solution uses AWS Secrets Manager, which natively orchestrates credential rotation. Because the target PostgreSQL database is legacy and on-premises, a custom Lambda function running in the private VPC is required to bridge the connectivity over AWS Direct Connect and safely update both the database password and the secrets store.

Step-by-Step Solution

1
Select a secrets management service that supports secure storage and automated rotation.
AWS Secrets Manager is chosen over Systems Manager Parameter Store because Secrets Manager has built-in integration for automated rotation schedules.
Parameter Store lacks native credential rotation orchestration and requires building custom schedulers and notification flows.
2
Ensure network connectivity for the rotation mechanism.
The Lambda rotation function must be associated with the VPC to route traffic over the AWS Direct Connect connection to the on-premises database.
Since the database is private on-premises, a Lambda function running outside the VPC cannot resolve or connect to the database endpoints.
3
Configure rotation mechanics using the rotation Lambda function.
The Lambda function updates the credential on the PostgreSQL database first, verifies connectivity, and then calls the Secrets Manager API to update the secret value.
This guarantees that the credential in the secret manager is always synchronized with the database, avoiding service disruption.

Key Concept

Secrets Manager vs Parameter Store Rotation and Encryption Mechanics
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic