Examkin

Question

Difficulty: HardSecrets and Parameter Management

A company is migrating a multi-tier application to AWS. The application consists of microservices running on AWS Fargate that require access to two different credentials: a database password for an Amazon RDS for PostgreSQL database that must be automatically rotated every 14 days, and a third-party API key that rarely changes but must be encrypted at rest using a customer managed key (CMK) with minimum retrieval cost. Which combination of actions should a solutions architect take to meet these requirements securely and cost-effectively? (Select TWO.)

  1. Store the PostgreSQL database credentials in AWS Secrets Manager, and configure the secret to rotate automatically using the database's built-in RDS rotation function.Answer
  2. Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter, specifying the customer managed KMS key for encryption.Answer
  3. C
    Store the database credentials in Systems Manager Parameter Store as a String parameter, and create a custom AWS Lambda function to update the database password every 14 days.
  4. D
    Store the database credentials in Systems Manager Parameter Store as a SecureString parameter, and configure AWS KMS customer managed key automatic rotation to rotate the database password every 14 days.
  5. E
    Store the API key in Systems Manager Parameter Store as a String parameter, and enable the default KMS automatic annual rotation for the parameter storage.

Answer

Store the database credentials in AWS Secrets Manager with built-in RDS PostgreSQL automatic rotation, and store the API key in Systems Manager Parameter Store as a SecureString parameter encrypted with the customer managed KMS key.
For the database credentials, AWS Secrets Manager is the correct choice because it natively manages database secrets and supports automatic rotation for RDS databases out-of-the-box. For the static API key, storing it as a SecureString in Systems Manager Parameter Store is the most secure and cost-effective approach since it supports encryption with customer managed KMS keys and has no storage costs for standard parameters.

Step-by-Step Solution

1
Analyze rotation requirements for database credentials.
The database credentials require automatic rotation every 14 days. Secrets Manager supports native, automatic rotation templates for Amazon RDS databases.
Using AWS Secrets Manager satisfies the automatic rotation requirement without building custom logic.
2
Analyze encryption and cost requirements for static secrets.
The third-party API key is static but must be encrypted at rest using a customer managed KMS key. Parameter Store with SecureString parameters supports customer managed KMS keys and provides standard parameter storage at no cost.
Using Systems Manager Parameter Store SecureString parameters for static secrets is more cost-effective than using Secrets Manager, which incurs a monthly cost per secret and additional retrieval fees.

Key Concept

Selecting the appropriate secrets management service based on rotation needs, encryption requirements, and cost-efficiency.
Estimated Time:2m 0s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic