Examkin

Question

Difficulty: MediumSecrets and Parameter Management

An enterprise application hosted on Amazon ECS Fargate needs to access two types of configuration data: database credentials for a production Amazon RDS for PostgreSQL instance, and public API endpoints for external microservices. The database credentials must be encrypted at rest, rotated every 30 days, and accessed securely. The public API endpoints are non-sensitive, do not change frequently, and must be retrieved with the lowest possible cost.

Which combination of actions should a solutions architect recommend to manage these configurations? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and enable automatic secret rotation with a schedule of 30 days.Answer
  2. Store the public API endpoints as Standard String parameters in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the database credentials as Standard String parameters in AWS Systems Manager Parameter Store to minimize storage costs.
  4. D
    Store the database credentials in AWS Systems Manager Parameter Store as SecureString parameters, and rely on AWS KMS automatic key rotation of the Customer Managed Key to automatically update the database password every 30 days.
  5. E
    Store both the database credentials and the public API endpoints as String parameters in AWS Systems Manager Parameter Store, relying on IAM policies to restrict decryption permissions.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation, and store the public API endpoints as Standard String parameters in AWS Systems Manager Parameter Store.
To securely manage sensitive and non-sensitive configuration data at the lowest cost, a solutions architect should use AWS Secrets Manager for database credentials and Systems Manager Parameter Store for public API endpoints. Secrets Manager encrypts data at rest and natively supports automatic 30-day rotation for Amazon RDS. For the non-sensitive API endpoints, Systems Manager Parameter Store's Standard String parameters are free of charge, making them the most cost-effective choice.

Step-by-Step Solution

1
Evaluate the security and rotation requirements of the database credentials.
Database credentials are sensitive secrets that require encryption at rest and automatic rotation every 30 days. AWS Secrets Manager is the optimal service because it provides built-in integration with RDS and automatic secret rotation via Lambda.
Systems Manager Parameter Store does not support out-of-the-box automatic database credential rotation, whereas Secrets Manager does.
2
Evaluate the storage and cost requirements of the non-sensitive public API endpoints.
The public API endpoints are non-sensitive and need to be stored at the lowest possible cost. Standard parameters (String type) in AWS Systems Manager Parameter Store do not incur additional costs.
Using AWS Secrets Manager for non-sensitive settings would incur unnecessary storage costs ($0.40 per secret per month).

Key Concept

Selecting the appropriate AWS service for configuration management based on data sensitivity, rotation requirements, and cost-effectiveness.
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic