Examkin

Question

Difficulty: EasySecrets and Parameter Management

A company is moving an on-premises application to Amazon EC2. The application needs to retrieve a sensitive API credential for an external payment service and a non-sensitive API endpoint URL for a weather forecasting service. A solutions architect needs to design a configuration storage strategy that is secure, cost-effective, and minimizes administrative overhead.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the payment service API credential as a SecureString parameter in AWS Systems Manager Parameter Store.Answer
  2. Store the weather forecasting service API endpoint URL as a String parameter in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the payment service API credential as a String parameter in AWS Systems Manager Parameter Store.
  4. D
    Store the weather forecasting service API endpoint URL as a SecureString parameter and configure AWS KMS to automatically rotate the parameter value every 24 hours.
  5. E
    Store the payment service API credential as a String parameter in AWS Systems Manager Parameter Store and enable KMS automatic key rotation to automatically update the credential value.

Answer

Store the payment service API credential as a SecureString parameter in AWS Systems Manager Parameter Store, and store the weather forecasting service API endpoint URL as a String parameter in AWS Systems Manager Parameter Store.
Storing the sensitive payment service API credential as a SecureString parameter in Systems Manager Parameter Store provides automatic encryption at rest using AWS KMS. Storing the non-sensitive weather forecasting service API endpoint URL as a standard String parameter in Parameter Store is the most secure and cost-effective approach, avoiding unnecessary KMS costs while utilizing a centralized parameter management solution.

Step-by-Step Solution

1
Identify the sensitivity of the configuration data.
The payment service API credential is sensitive and requires encryption, while the weather forecasting service API endpoint is non-sensitive.
This determines which storage parameters require encryption and which can be stored in plaintext.
2
Select the appropriate parameter type in AWS Systems Manager Parameter Store.
Use a SecureString parameter for the sensitive credential to encrypt it at rest using AWS KMS, and use a standard String parameter for the non-sensitive URL endpoint to save on overhead and encryption resource costs.
This implements the principle of least privilege and optimizes cost and management overhead.

Key Concept

AWS Systems Manager Parameter Store supports String parameters for plaintext configurations and SecureString parameters for sensitive configuration data encrypted by AWS KMS.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic