Examkin

Question

Difficulty: HardData Encryption and Key Management

A company is deploying an application on Amazon EC2 instances that connects to an Amazon RDS for PostgreSQL database. The company's security policy requires database credentials to be encrypted and rotated every 30 days. Additionally, the master key used to encrypt these credentials must be a customer managed KMS key that is rotated annually. The solutions architect must implement a solution that minimizes administrative overhead and prevents the application from storing credentials in plaintext configuration files.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic credentials rotation every 30 days using an AWS Lambda function.Answer
  2. Enable automatic key rotation on the customer managed KMS key to rotate the key material annually without changing the key ARN.Answer
  3. C
    Store the database credentials as a String parameter in AWS Systems Manager Parameter Store to simplify configuration management and rotation.
  4. D
    Create a new customer managed KMS key annually, manually re-encrypt the credentials in Secrets Manager with the new key, and update the application configuration.
  5. E
    Enable automatic rotation on the AWS managed KMS key (aws/secretsmanager) and configure it to rotate the secret every 30 days.

Answer

To secure the database credentials and satisfy the rotation requirements, store the credentials in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function, and enable automatic key rotation on the customer managed KMS key to rotate the key material annually without changing the key ARN.
Storing database credentials in AWS Secrets Manager with Lambda-based rotation enables secure, automated credential rotation every 30 days. Additionally, enabling automatic key rotation on the customer managed KMS key meets the requirement for annual key rotation with zero administrative overhead and no change to the key ARN.

Step-by-Step Solution

1
Store the database credentials in AWS Secrets Manager.
The credentials are encrypted at rest using a customer managed KMS key and are accessible via the Secrets Manager API.
This avoids storing credentials in plaintext configuration files on the EC2 instances.
2
Configure automatic rotation for the secret in Secrets Manager.
A predefined AWS Lambda function is configured to rotate the PostgreSQL database credentials every 30 days.
This meets the requirement to rotate the database credentials every 30 days automatically.
3
Enable automatic key rotation on the customer managed KMS key.
AWS KMS automatically rotates the key material once a year.
This rotates the key material annually while keeping the same key ARN, ensuring no disruption to Secrets Manager or the application.

Key Concept

Key rotation in AWS KMS is separate from secret rotation in AWS Secrets Manager. KMS automatic rotation rotates the underlying key material without changing the key ARN, while Secrets Manager handles updating credentials in the target database.
Estimated Time:2m 0s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic