Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM)

A solutions architect is reviewing the security of a web application running on Amazon EC2 instances. The solutions architect finds that a database password is currently stored as a plaintext string parameter in Systems Manager Parameter Store. The company requires the database credentials to be encrypted at rest and rotated automatically every 30 days. Which solution should the solutions architect implement to meet these requirements?

  1. Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.Answer
  2. B
    Store the credentials as a standard String parameter in Systems Manager Parameter Store and restrict access using an IAM policy.
  3. C
    Store the credentials as a SecureString parameter in Systems Manager Parameter Store, and configure the application to use the AWS account root user credentials to retrieve them.
  4. D
    Store the credentials as a SecureString parameter in Systems Manager Parameter Store, and enable AWS KMS automatic key rotation to rotate the database password.

Answer

Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.
AWS Secrets Manager natively supports both encryption at rest and automatic credential rotation (such as for Amazon RDS databases) without requiring custom code or infrastructure. The application can securely query Secrets Manager at runtime to retrieve the current password.

Step-by-Step Solution

1
Identify the secure storage service that natively supports automatic credential rotation.
AWS Secrets Manager is chosen because it integrates directly with database services to handle password rotation automatically.
This avoids custom scripting overhead and satisfies the security requirements.
2
Configure the application to dynamically fetch the credentials at runtime using the AWS SDK.
The application is updated to call the Secrets Manager API instead of hardcoding or querying plaintext parameters.
Ensures the application always uses the active, rotated credentials securely.

Key Concept

Secure secrets storage and lifecycle management using AWS Secrets Manager
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic