Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A solutions architect is designing a secure architecture for a serverless web application. The application consists of AWS Lambda functions that need to query an Amazon RDS for PostgreSQL database. The database credentials must not be hardcoded in the application code, must be encrypted at rest, and must be rotated every 30 days without manual intervention or application downtime. Which combination of steps should the solutions architect perform to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS-managed rotation function for Amazon RDS.Answer
  2. Configure the AWS Lambda function to retrieve the credentials dynamically at runtime using the Secrets Manager API, and grant the Lambda execution role permissions to retrieve the secret value.Answer
  3. C
    Store the database credentials as a plaintext String parameter in AWS Systems Manager Parameter Store to simplify Lambda environment configuration.
  4. D
    Configure a Systems Manager Parameter Store SecureString parameter and enable KMS automatic key rotation to rotate the database password every 30 days.
  5. E
    Store the credentials as environment variables in the Lambda function and enable AWS Key Management Service (AWS KMS) automatic key rotation to rotate the credentials.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS-managed rotation function for Amazon RDS, and configure the AWS Lambda function to retrieve the credentials dynamically at runtime using the Secrets Manager API, granting the Lambda execution role permissions to retrieve the secret value.
Storing database credentials in AWS Secrets Manager allows for secure storage with encryption at rest using AWS KMS. Secrets Manager natively supports automatic rotation for Amazon RDS databases using a built-in AWS-managed Lambda function, which updates both the database password and the secret value without downtime. The Lambda function must dynamically retrieve these credentials at runtime via the Secrets Manager API, which requires that the Lambda function's IAM execution role has permissions to retrieve the secret value.

Step-by-Step Solution

1
Store the database credentials securely in AWS Secrets Manager.
The sensitive database credentials are encrypted at rest using AWS KMS.
Hardcoding secrets violates security standards; Secrets Manager provides central encrypted storage.
2
Configure AWS Secrets Manager to automatically rotate the secret every 30 days using the built-in Amazon RDS rotation template.
Secrets Manager automatically updates the password on the RDS PostgreSQL instance and updates the secret value concurrently.
This satisfies the requirement for automatic password rotation without application downtime or manual intervention.
3
Configure the AWS Lambda function to query the secret value dynamically at runtime using the AWS SDK.
The Lambda function retrieves the most current credentials directly from Secrets Manager.
Dynamically querying the credentials ensures the application always uses the rotated password without needing redeployment.
4
Grant the Lambda function's IAM execution role permission to retrieve the secret value.
The Lambda function is authorized to access the credentials at runtime.
Least privilege access must be enforced, allowing only authorized serverless components to decrypt the secret.

Key Concept

AWS Secrets Manager automatic RDS rotation and secure IAM access pattern for Lambda.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic