Examkin

Question

Difficulty: EasySecrets and Parameter Management

A company is developing a web application that runs on Amazon EC2 instances and connects to an Amazon RDS for PostgreSQL database. The database credentials must be encrypted at rest and rotated every 30 days. The solutions architect needs to design a secure solution to manage these credentials with minimal administrative overhead. Which two actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database credentials as a secret in AWS Secrets Manager.Answer
  2. Enable automatic rotation for the secret and configure it to use a pre-configured AWS Lambda function designed for Amazon RDS.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a plain String parameter.
  4. D
    Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter and enable AWS KMS key rotation to rotate the credential values.
  5. E
    Store the database credentials directly in AWS KMS and configure a KMS key policy to automatically rotate the credentials annually.

Answer

To securely manage database credentials, the solutions architect should store the credentials in AWS Secrets Manager and enable automatic rotation using a pre-configured AWS Lambda function tailored for Amazon RDS.
AWS Secrets Manager secures database credentials at rest using KMS encryption. By combining it with a pre-configured AWS Lambda function, Secrets Manager can safely update the database credentials on a schedule (such as every 30 days) and update the secret store automatically, satisfying all requirements with minimal administrative effort.

Step-by-Step Solution

1
Select a secure storage service for the credentials that supports automatic rotation.
AWS Secrets Manager is chosen because it encrypts secrets at rest and natively supports automatic rotation for Amazon RDS databases.
Systems Manager Parameter Store does not offer native, out-of-the-box automatic rotation for RDS databases without custom Lambda functions, which increases administrative overhead.
2
Configure the rotation mechanism for the database credentials.
Enable automatic rotation on the secret, electing to use the RDS rotation template which deploys a pre-configured AWS Lambda function.
The Lambda function executes the rotation lifecycle (updating credentials in RDS and the secret value in Secrets Manager) without modifying application code.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store rotation and encryption capabilities.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic