Examkin

Question

Difficulty: HardSecrets and Parameter Management

A company has a global logistics application deployed on Amazon Elastic Kubernetes Service (EKS) across two AWS regions: us-east-1 and eu-west-1. The application requires access to a proprietary third-party API key to query shipping rates. The API key must be encrypted at rest using a customer managed key (CMK) and must be rotated automatically every 90 days. The application in both regions must retrieve the key with minimal latency. Which combination of actions should a solutions architect recommend to meet these requirements with the least operational overhead? (Select TWO.)

  1. Store the API key as a secret in AWS Secrets Manager in us-east-1, and configure replication of the secret to eu-west-1.Answer
  2. Create an AWS Lambda function that performs the API key rotation, and configure AWS Secrets Manager to trigger the function every 90 days.Answer
  3. C
    Store the API key as a plaintext String parameter in AWS Systems Manager Parameter Store to allow direct access from both regions without decryption overhead.
  4. D
    Enable automatic key rotation on the KMS customer managed key (CMK) that encrypts the API key secret to automatically rotate the API key value every 90 days.
  5. E
    Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, and configure KMS key rotation to automatically update the API key value every 90 days.

Answer

Store the API key as a secret in AWS Secrets Manager in us-east-1 with replication to eu-west-1, and create an AWS Lambda function triggered by Secrets Manager to rotate the secret every 90 days.
Storing the API key in AWS Secrets Manager with native replication to another region ensures local low-latency access in both regions. Creating a custom Lambda function to rotate the secret and scheduling it via Secrets Manager satisfies the 90-day automatic rotation requirement.

Step-by-Step Solution

1
Select a secure storage service that supports cross-region replication and automatic rotation.
AWS Secrets Manager is chosen because it supports native replication to multiple regions (for low-latency access in us-east-1 and eu-west-1) and built-in integration with AWS Lambda for automatic rotation.
Systems Manager Parameter Store does not support native cross-region replication or built-in rotation schedules for custom secrets, which would increase operational overhead.
2
Configure the replication of the secret from the primary region to the secondary region.
The secret is stored in us-east-1 and replicated to eu-west-1, allowing EKS pods in both regions to query local replica secrets with minimal latency.
This satisfies the requirement to access the secret with low latency across regions.
3
Implement automatic rotation of the third-party API key.
A custom AWS Lambda function is developed to interact with the third-party provider and update the secret value in Secrets Manager. Secrets Manager is configured to run this Lambda function every 90 days.
Since the API key belongs to a third-party service, automatic rotation requires custom logic implemented via a Lambda function. KMS key rotation only rotates the backing KMS key, not the secret content itself.

Key Concept

AWS Secrets Manager supports native cross-region replication and automated custom secret rotation via AWS Lambda functions, whereas KMS key rotation only rotates the cryptographic keys and not the secrets themselves.
Estimated Time:2m 0s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic