Examkin

Question

Difficulty: EasySecrets and Parameter Management

A company is migrating a web application to Amazon EC2 instances. The application requires access to an Amazon RDS for PostgreSQL database. To comply with security policies, the database credentials must be encrypted at rest and automatically rotated every 30 days without causing application downtime. Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager.Answer
  2. Configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.Answer
  3. C
    Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store.
  4. D
    Store the database credentials as a SecureString parameter in AWS Systems Manager Parameter Store and enable automatic annual rotation of the customer managed AWS KMS key.
  5. E
    Store the database credentials in a plaintext environment variable within the EC2 instance launch template.

Answer

Store the database credentials in AWS Secrets Manager, and configure AWS Secrets Manager to rotate the database credentials automatically using an AWS Lambda function.
AWS Secrets Manager is designed specifically to secure database credentials. Storing credentials in Secrets Manager ensures encryption at rest, and configuring Secrets Manager automatic rotation via an AWS Lambda function updates both the secret and the Amazon RDS database, fulfilling all requirements securely without downtime.

Step-by-Step Solution

1
Identify the service that supports secure secret storage and native automatic rotation.
AWS Secrets Manager is chosen over Systems Manager Parameter Store because Secrets Manager natively supports automatic rotation of database credentials.
Parameter Store does not have built-in support for rotating credentials on a schedule.
2
Enable automatic rotation for the secret.
Configure AWS Secrets Manager with a rotation schedule and an AWS Lambda function to update the database credentials.
Secrets Manager uses a Lambda function to update the credentials in both Secrets Manager and the target Amazon RDS database concurrently without downtime.

Key Concept

AWS Secrets Manager is the standard service for storing, encrypting, and automatically rotating database credentials.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic