Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A solutions architect is designing a batch data processing workload running on Amazon ECS using the AWS Fargate launch type. The application requires access to a database connection string containing sensitive credentials that must be rotated every 30 days, and a non-sensitive configuration endpoint URL that remains static. The solutions architect needs to design a secure, cost-effective storage and retrieval strategy with minimal operational overhead.

Which combination of services should the solutions architect recommend to meet these requirements?

  1. A
    Store the database connection string and the configuration endpoint URL as standard String parameters in AWS Systems Manager Parameter Store.
  2. Store the database connection string in AWS Secrets Manager and configure automatic rotation. Store the configuration endpoint URL as a String parameter in Systems Manager Parameter Store.Answer
  3. C
    Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store, and enable automatic key rotation on the associated AWS KMS customer managed key.
  4. D
    Store the database connection string directly as a plaintext environment variable in the Amazon ECS task definition, and store the configuration endpoint URL in Systems Manager Parameter Store.

Answer

The most secure and cost-effective approach is to store the database connection string in AWS Secrets Manager with automatic rotation enabled, and store the non-sensitive configuration endpoint URL as a String parameter in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive data such as database credentials and supports built-in automatic rotation using AWS Lambda. For non-sensitive application configurations, AWS Systems Manager Parameter Store is a cost-effective and low-overhead solution when using standard String parameters. Combining both services optimizes cost while meeting security and operational requirements.

Step-by-Step Solution

1
Analyze security and rotation requirements for the sensitive database credentials.
The database connection string is highly sensitive and requires automatic rotation every 30 days. AWS Secrets Manager is the optimal choice as it natively integrates database credential rotation using AWS Lambda.
Secrets Manager provides built-in lifecycle management and rotation features, whereas Systems Manager Parameter Store does not natively orchestrate database-side rotation out of the box.
2
Evaluate storage and cost requirements for the non-sensitive configuration URL.
The configuration endpoint URL is non-sensitive and static. AWS Systems Manager Parameter Store using standard String parameters is free of charge and requires minimal overhead.
Using Secrets Manager for non-sensitive, static configs adds unnecessary monthly costs ($0.40 per secret) and API call overhead, which violates cost-optimization principles.
3
Combine the storage choices into a unified architecture.
Integrate AWS Secrets Manager (for connection strings) and Systems Manager Parameter Store (for static URLs) with the ECS task definition.
This hybrid approach leverages the strength of each service, securing sensitive resources while minimizing AWS expenditure.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on data sensitivity, rotation needs, and cost efficiency.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic