Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A company is building a serverless ETL pipeline using AWS Glue. The pipeline runs multiple jobs that need to connect to an on-premises database. To establish this connection, the Glue jobs require a database password that is subject to a strict regulatory policy requiring rotation every 60 days. The jobs also require the database port number, which is static and does not contain sensitive information. The solutions architect must design a secure, cost-effective solution with minimal operational overhead.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.Answer
  2. Store the database port number in AWS Systems Manager Parameter Store as a String parameter.Answer
  3. C
    Store the database password in AWS Systems Manager Parameter Store as a String parameter to avoid the monthly cost of AWS Secrets Manager.
  4. D
    Enable automatic rotation on the AWS KMS customer managed key (CMK) used for encryption to automatically rotate the database password every 60 days.
  5. E
    Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter and enable the native Parameter Store automatic 60-day rotation feature.

Answer

Store the database password in AWS Secrets Manager with AWS Lambda-based automatic rotation, and store the database port number in AWS Systems Manager Parameter Store as a String parameter.
To securely manage the database password with automatic 60-day rotation, AWS Secrets Manager is the optimal choice because it integrates with AWS Lambda to orchestrate credential rotation on databases. For the non-sensitive and static database port number, AWS Systems Manager Parameter Store as a standard String parameter is the most cost-effective solution because Parameter Store does not charge for standard parameters.

Step-by-Step Solution

1
Analyze configuration requirements and separate sensitive data from non-sensitive data.
The database password is identified as sensitive and requires rotation; the database port is identified as static and non-sensitive.
This separation allows for a cost-effective design where expensive secrets management is only used for data that strictly requires it.
2
Select the appropriate storage service for the database password.
Choose AWS Secrets Manager, encrypt it with KMS, and configure an AWS Lambda function to rotate the password every 60 days.
Secrets Manager natively supports automatic rotation of credentials, which meets the 60-day rotation requirement with minimal operational overhead.
3
Select the appropriate storage service for the database port.
Choose AWS Systems Manager Parameter Store and store it as a standard String parameter.
Parameter Store standard parameters are free and ideal for non-sensitive, static parameters, avoiding unnecessary Secrets Manager costs.

Key Concept

Selecting the appropriate AWS service for secrets versus parameters based on security, rotation requirements, and cost-effectiveness.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic