Examkin

Question

Difficulty: MediumSecrets and Parameter Management

An online retail application hosted on AWS Lambda requires access to an external payment gateway API key that must be rotated every 30 days. The application also requires access to several non-sensitive configuration settings, including timeout values and API endpoints. The architecture must minimize cost while ensuring that the sensitive API key is encrypted at rest and rotated automatically without manual intervention. Which parameter management strategy should a solutions architect implement to meet these requirements with the lowest operational overhead?

  1. Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store. Store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.Answer
  2. B
    Store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store. Enable automatic key rotation on the associated AWS Key Management Service (AWS KMS) customer managed key to automatically rotate the payment gateway API key value every 30 days.
  3. C
    Store both the non-sensitive configuration settings and the payment gateway API key as Standard plaintext String parameters in AWS Systems Manager Parameter Store, using a scheduled AWS Lambda function to update the values.
  4. D
    Store all configuration settings and the payment gateway API key in AWS Systems Manager Parameter Store as StringList parameters, enabling AWS KMS encryption on the parameter path to secure the sensitive values without incurring Secrets Manager costs.

Answer

Store the non-sensitive parameters as Standard parameters in AWS Systems Manager Parameter Store, store the payment gateway API key in AWS Secrets Manager, and configure automatic rotation using an AWS Lambda function.
The correct solution uses AWS Systems Manager Parameter Store for non-sensitive parameters, which is cost-effective, and AWS Secrets Manager for the sensitive API key. Secrets Manager supports automatic rotation natively through integration with AWS Lambda, ensuring that the 30-day rotation requirement is met with minimal custom development or operational maintenance.

Step-by-Step Solution

1
Identify parameter types and security requirements.
Non-sensitive settings (timeout, endpoints) do not require encryption or rotation. The payment gateway API key requires encryption at rest and automatic rotation every 30 days.
This determines the appropriate service for each parameter class to optimize cost and security.
2
Select the parameter storage service based on cost and capability constraints.
Use Systems Manager Parameter Store Standard parameters for non-sensitive settings to avoid cost. Use AWS Secrets Manager for the API key to utilize its native rotation integration.
Parameter Store standard parameters are free, whereas Secrets Manager charges per secret but provides built-in rotation management.
3
Configure automatic rotation for the API key.
Configure AWS Secrets Manager to rotate the API key every 30 days using a rotation AWS Lambda function.
This automates the rotation lifecycle of the external API key, meeting the security mandate with the least operational overhead.

Key Concept

Secrets Manager vs Parameter Store Trade-offs
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic