Examkin

Question

Difficulty: MediumSecrets and Parameter Management

An enterprise is deploying a microservice application on Amazon ECS. The application requires access to a Microsoft SQL Server database running on Amazon RDS. The security team mandates that the database credentials must be encrypted at rest and rotated every 30 days without downtime or manual intervention. Which strategy should a solutions architect recommend to meet these requirements with the least operational overhead?

  1. Store the database credentials in AWS Secrets Manager. Configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.Answer
  2. B
    Store the credentials as a plaintext String parameter in AWS Systems Manager Parameter Store. Write a scheduled Amazon EventBridge rule that triggers an AWS Lambda function to update the database password.
  3. C
    Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Enable AWS KMS automatic key rotation on the customer managed key used for encryption to automatically rotate the underlying credentials.
  4. D
    Store the credentials as a plaintext String parameter in AWS Systems Manager Parameter Store, and configure an IAM policy that allows only the application's ECS task execution role to decrypt the parameter.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in Secrets Manager rotation template integrated with a helper AWS Lambda function.
AWS Secrets Manager is specifically designed for database credential management. It encrypts secrets at rest using AWS Key Management Service (KMS) and provides built-in integration with AWS Lambda to rotate credentials automatically. By using the provided rotation templates for Amazon RDS databases, a solutions architect can achieve automatic rotation with minimal operational effort.

Step-by-Step Solution

1
Select a secure, encrypted storage service that supports automatic credential rotation.
AWS Secrets Manager is selected because it integrates directly with AWS KMS for encryption at rest and natively supports secret rotation.
Systems Manager Parameter Store SecureString parameters support encryption but do not have built-in, out-of-the-box automatic rotation for database credentials.
2
Configure the rotation mechanism for the database credentials.
Use the native integration in AWS Secrets Manager to configure a Lambda function based on the standard rotation template for RDS.
This configuration automatically updates the database password on both the database instance and the stored secret, avoiding manual intervention and minimizing operational overhead.

Key Concept

AWS Secrets Manager provides native support for the lifecycle management, encryption, and automatic rotation of sensitive credentials like database passwords.
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic