Examkin

Question

Difficulty: HardSecrets and Parameter Management

A company is developing a high-throughput financial ledger application running on Amazon EKS across multiple AWS accounts. The containerized application pods need access to:
1. A third-party payment gateway API password that must be encrypted at rest and rotated automatically every 45 days.
2. Regional service endpoint URLs (non-sensitive) that must be retrieved with minimal latency and zero additional storage cost.
Additionally, the security team requires that the AWS KMS customer managed key (CMK) used to encrypt the credentials must be rotated annually. The operations team incorrectly believes that this annual rotation will automatically decrypt and re-encrypt all historical database backups and secrets logs using the new key version.

Which combination of configurations should a solutions architect recommend to satisfy these requirements?

  1. Store the database password in AWS Secrets Manager with automatic rotation configured for 45 days, and retrieve it using the AWS Secrets Manager CSI provider. Store the endpoint URLs as String parameters in AWS Systems Manager Parameter Store. Enable automatic key rotation for the KMS CMK, and clarify to the team that key rotation does not re-encrypt historical data, which remains decryptable using the archived key version.Answer
  2. B
    Store the database password as a String parameter in AWS Systems Manager Parameter Store to minimize cost, and retrieve it using an EKS startup script. Store the endpoint URLs in AWS Secrets Manager. Enable automatic key rotation for the KMS CMK, and clarify to the team that key rotation does not re-encrypt historical data, which remains decryptable using the archived key version.
  3. C
    Store the database password in AWS Secrets Manager with automatic rotation configured for 45 days, and retrieve it using the AWS Secrets Manager CSI provider. Store the endpoint URLs as String parameters in AWS Systems Manager Parameter Store. Enable automatic key rotation for the KMS CMK, and advise the team that the KMS service will automatically run a background process to decrypt and re-encrypt all historical transaction data under the new key version.
  4. D
    Store both the database password and the endpoint URLs as String parameters in AWS Systems Manager Parameter Store to avoid Secrets Manager monthly fees. Enable automatic key rotation for the KMS CMK, and advise the team that the KMS service will automatically run a background process to decrypt and re-encrypt all historical transaction data under the new key version.

Answer

Store the database password in AWS Secrets Manager with automatic rotation, store the endpoint URLs in AWS Systems Manager Parameter Store as String parameters, and enable KMS key rotation while clarifying that historical data is not automatically re-encrypted.
The correct configuration uses AWS Secrets Manager for the database password to leverage automatic 45-day rotation and secure EKS integration. Non-sensitive endpoint URLs are stored as String parameters in Parameter Store for zero storage cost. Enabling KMS key rotation is recommended, but the solutions architect must clarify that KMS does not automatically re-encrypt historical data; instead, it retains the old key version to allow decryption of existing data.

Step-by-Step Solution

1
Determine the storage for sensitive credentials requiring automatic rotation.
AWS Secrets Manager is chosen for the database password because it natively supports automatic rotation (e.g., using AWS Lambda) and integrates with EKS via the CSI provider.
Parameter Store does not natively manage secrets rotation lifecycles, and Secrets Manager is designed specifically for securing and rotating credentials.
2
Determine the storage for non-sensitive regional endpoints.
AWS Systems Manager Parameter Store with the String data type is selected.
String parameters in Parameter Store are free of charge for standard parameters and provide low-latency configuration retrieval, minimizing costs for non-sensitive data.
3
Analyze KMS Key Rotation behavior for customer managed keys (CMKs).
Explain that enabling automatic key rotation creates a new backing key version for new encryption operations, but does not re-encrypt existing historical data.
Historical data remains encrypted with the previous backing key version, which AWS KMS automatically retains to decrypt older data when requested.

Key Concept

AWS Secrets Manager is preferred for credentials requiring automated rotation. AWS Systems Manager Parameter Store offers a cost-effective solution for non-sensitive configurations. AWS KMS key rotation creates a new key version for future operations but does not re-encrypt existing data.
Estimated Time:2m 30s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic