Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A solutions architect is designing a secure credential storage solution for a legacy application hosted on Amazon EC2 instances. The application requires access to database credentials for an Amazon RDS for PostgreSQL database, which must be rotated automatically every 30 days. Additionally, the application requires access to a static third-party API token that must be encrypted at rest but does not require automatic rotation. The solution must minimize monthly operational costs and configuration complexity. Which combination of actions should the solutions architect take to meet these requirements? (Choose two.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.Answer
  2. Store the external API token as a SecureString parameter in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the database credentials as a String parameter in AWS Systems Manager Parameter Store to minimize storage and retrieval costs.
  4. D
    Store the database credentials as a SecureString parameter in AWS Systems Manager Parameter Store and enable AWS Key Management Service (AWS KMS) automatic key rotation to rotate the database credentials every 30 days.
  5. E
    Store the external API token in an Amazon S3 bucket as a plaintext text file and enable S3 versioning to manage rotation.

Answer

Store the database credentials in AWS Secrets Manager with built-in RDS rotation, and store the external API token as a SecureString parameter in AWS Systems Manager Parameter Store.
Storing database credentials in AWS Secrets Manager is the best approach because it natively supports automatic rotation for RDS databases. Storing the static API token as a SecureString parameter in AWS Systems Manager Parameter Store provides encryption-at-rest at lower operational cost and complexity since the token does not require automatic rotation.

Step-by-Step Solution

1
Analyze the database credentials requirements.
The database credentials need to be rotated automatically every 30 days.
AWS Secrets Manager is the correct service for secrets requiring automatic rotation because it provides built-in integration and Lambda rotation templates for Amazon RDS databases.
2
Analyze the static API token requirements.
The token is static, does not require rotation, but must be encrypted at rest.
AWS Systems Manager Parameter Store with SecureString parameters provides secure, KMS-encrypted parameter storage with no additional cost for standard parameters, making it highly cost-effective for static secrets.
3
Evaluate the distractors against security and operational rules.
Reject plaintext storage options and options that misinterpret KMS key rotation mechanics.
String parameters and plaintext S3 files lack required encryption. KMS key rotation does not update the underlying database credentials or parameter values.

Key Concept

Selecting the appropriate secrets management service based on rotation capabilities, encryption needs, and cost profiles.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic