Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A telemetry data processing system runs on Amazon Elastic Container Service (Amazon ECS) tasks inside a private subnet. The system requires secure access to three configuration items: database credentials for an Amazon RDS for MySQL DB instance that must be rotated every 30 days, a static API key for an external mapping provider, and the database endpoint host address along with the application logging verbosity level. The solutions architect needs to design a secure storage and rotation solution that minimizes costs and operational overhead. Which two options should the solutions architect select to meet these requirements?

  1. Store the database credentials in AWS Secrets Manager, and configure automatic rotation using the built-in Amazon RDS rotation template.Answer
  2. B
    Store the database credentials and the mapping provider API key as String parameters in AWS Systems Manager Parameter Store to eliminate AWS Secrets Manager pricing.
  3. Store the database endpoint, logging verbosity level, and the external API key in AWS Systems Manager Parameter Store, using String parameters for non-sensitive data and a SecureString parameter for the API key.Answer
  4. D
    Enable automatic key rotation on the AWS KMS customer managed key used to encrypt the Secrets Manager secrets, expecting this to automatically update and rotate the database credentials every 30 days.
  5. E
    Store the database credentials as a String parameter in AWS Systems Manager Parameter Store, and write a custom AWS Lambda function to perform rotation every 30 days.

Answer

Store the database credentials in AWS Secrets Manager with automatic RDS rotation enabled, and store the non-sensitive parameters as String parameters and the API key as a SecureString parameter in AWS Systems Manager Parameter Store.
To satisfy the requirements securely and cost-effectively, the database credentials should be stored in AWS Secrets Manager, which natively supports automatic 30-day rotation for Amazon RDS DB instances. Non-sensitive settings (database endpoint and logging level) and the static API key should be stored in AWS Systems Manager Parameter Store. Using String parameters for the non-sensitive configuration and a SecureString parameter for the API key ensures both security and cost efficiency.

Step-by-Step Solution

1
Analyze the security and rotation requirements for each configuration item.
The database credentials require rotation every 30 days, which makes AWS Secrets Manager the ideal service due to its built-in RDS rotation templates. The external API key is static and does not require automatic rotation, meaning it can be securely stored in AWS Systems Manager Parameter Store.
Evaluating rotation needs determines the proper secrets management service, aligning with security requirements while optimizing for simplicity.
2
Select the most cost-effective parameters for non-sensitive data.
The database endpoint and logging verbosity are non-sensitive configuration items and should be stored as free standard String parameters in Parameter Store.
Using Parameter Store for non-sensitive parameters avoids the monthly per-secret cost of AWS Secrets Manager.
3
Evaluate the encryption requirements for static sensitive data.
The static API key is sensitive and must be encrypted at rest. It should be stored as a SecureString parameter in Systems Manager Parameter Store, which is backed by AWS KMS.
SecureString parameters provide free storage (with standard parameters limit) and secure KMS-based encryption for sensitive, non-rotating values.

Key Concept

AWS Secrets Manager provides native support for rotating active credentials such as database passwords, while AWS Systems Manager Parameter Store is a cost-effective service for static secrets (using SecureString) and non-sensitive configuration data (using String parameters).
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic