Examkin

Question

Difficulty: HardSecrets and Parameter Management

An organization runs a containerized payment processing service on Amazon ECS that requires credentials to access an Amazon RDS for MySQL database. The organization's security policy requires the database credentials to be rotated every 30 days. Additionally, the AWS Key Management Service (AWS KMS) customer managed key used to encrypt the credentials must be rotated annually. The policy also specifies that once the KMS key is rotated, the stored credentials must be immediately re-encrypted with the new key material to ensure that the retired key material is no longer used to protect the active credentials. Which solution should a solutions architect recommend to satisfy these security requirements?

  1. Store the credentials in AWS Secrets Manager with automatic rotation enabled on a 30-day schedule. Enable automatic key rotation on the KMS customer managed key. Configure an AWS Lambda function triggered by AWS CloudTrail events for KMS key rotation to programmatically update the secret value, forcing Secrets Manager to re-encrypt the credentials using the new key material.Answer
  2. B
    Store the credentials in AWS Systems Manager Parameter Store as a String parameter. Configure an Amazon EventBridge rule to trigger an AWS Lambda function every 30 days to rotate the database credentials and update the parameter. Enable automatic key rotation on the KMS customer managed key.
  3. C
    Store the credentials in AWS Secrets Manager with automatic rotation enabled on a 30-day schedule. Enable automatic key rotation on the KMS customer managed key, which automatically and immediately re-encrypts the existing database credentials in Secrets Manager with the new key material.
  4. D
    Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Enable automatic rotation for the parameter on a 30-day schedule. Enable automatic key rotation on the KMS customer managed key, and configure Parameter Store to automatically re-encrypt the parameter value using the new key version.

Answer

Store the credentials in AWS Secrets Manager with 30-day automatic rotation, enable automatic key rotation on the KMS customer managed key, and use a Lambda function triggered by CloudTrail key rotation events to programmatically update and re-encrypt the secret.
The correct solution uses AWS Secrets Manager for database credentials because it provides built-in 30-day automatic rotation for RDS databases. Since automatic KMS customer managed key rotation does not retroactively re-encrypt existing ciphertexts, a custom workflow using AWS CloudTrail, EventBridge, and AWS Lambda is required to detect the key rotation event, retrieve the secret, and update it. This update action forces Secrets Manager to request a new encryption operation from KMS, which will use the newly rotated key material to encrypt the active credentials immediately.

Step-by-Step Solution

1
Store database credentials in AWS Secrets Manager and enable built-in automatic rotation.
Automatic rotation of the RDS MySQL credentials occurs every 30 days without custom orchestration code.
Secrets Manager natively supports scheduled rotation for RDS databases, reducing operational overhead.
2
Enable automatic key rotation for the KMS Customer Managed Key (CMK) used to encrypt the secret.
The KMS key material is rotated automatically every year.
This satisfies the requirement for annual encryption key rotation without manual intervention.
3
Implement an AWS Lambda function triggered by EventBridge when a CloudTrail API call logs the KMS key rotation event to update the secret.
The active credentials in Secrets Manager are retrieved and re-saved, resulting in immediate re-encryption with the new key material.
Since automatic KMS key rotation does not retroactively re-encrypt existing ciphertexts, re-saving the secret programmatically forces the use of the new key version.

Key Concept

AWS KMS key rotation mechanics do not retroactively re-encrypt existing ciphertexts; dynamic re-encryption requires a re-save or manual re-encryption operation.
Estimated Time:2m 30s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic