Examkin

Question

Difficulty: HardSecrets and Parameter Management

An enterprise is deploying a high-volume payment processing application on Amazon ECS using the AWS Fargate launch type. The application requires access to a sensitive API key for a third-party payment gateway. The API key must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) and must be rotated every 90 days. The application tasks scale dynamically, launching and terminating thousands of containers daily, and the application queries the third-party gateway frequently, which requires reading the API key multiple times per minute. The solutions architect must design a secure, cost-effective secrets management solution that automates key rotation with zero downtime. Which combination of actions should the solutions architect recommend to meet these requirements? (Select TWO.)

  1. Store the API key as a secret in AWS Secrets Manager, and configure a custom AWS Lambda function to rotate the API key every 90 days.Answer
  2. Use the AWS Secrets Manager client-side caching library in the ECS application containers to retrieve and cache the API key.Answer
  3. C
    Store the API key as a plaintext String parameter in AWS Systems Manager Parameter Store to avoid Secrets Manager storage costs, and enable automatic key rotation on the AWS KMS customer managed key.
  4. D
    Enable automatic rotation on the AWS KMS customer managed key to automatically update the API key value and re-encrypt the secret in Secrets Manager every 90 days.
  5. E
    Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store, and configure the AWS KMS customer managed key to automatically trigger a Lambda function to rotate the parameter when the key is rotated.

Answer

Store the API key as a secret in AWS Secrets Manager with a custom AWS Lambda function for rotation, and implement the client-side caching library in the ECS application containers to minimize API call costs.
The correct solution uses AWS Secrets Manager to store the secret and a custom AWS Lambda function to orchestrate rotation because Secrets Manager lacks a built-in template for custom third-party APIs. To optimize API costs and latency under high container scaling and frequent API requests, client-side caching should be implemented in the ECS container code, allowing the container to fetch the secret from a local memory cache rather than querying the AWS Secrets Manager API and KMS decrypt operation on every request.

Step-by-Step Solution

1
Store the sensitive API key securely using AWS Secrets Manager.
The secret is encrypted at rest using the specified AWS KMS Customer Managed Key (CMK).
Secrets Manager provides secure storage and native integration with KMS for encrypting secrets.
2
Implement a custom AWS Lambda function to manage secret rotation.
The API key is rotated every 90 days by calling the third-party payment gateway's API and updating the secret value in Secrets Manager.
Since the API key belongs to a third-party gateway, there is no built-in Secrets Manager rotation template, necessitating custom Lambda code.
3
Implement client-side caching within the ECS container application using the AWS Secrets Manager caching library.
Frequent lookups of the secret are served from the local cache instead of making remote API calls to Secrets Manager and AWS KMS.
Caching drastically reduces API invocation costs and database latency under high query volumes and dynamic scaling conditions.

Key Concept

Secrets management and key rotation for third-party integrations with cost optimization.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic