Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A company is deploying a serverless microservice on AWS Lambda that requires access to a third-party payment gateway's API key. Security policies mandate that the API key must be encrypted at rest and rotated every 30 days. The rotation process must be automated, and the Lambda function should retrieve the latest key at runtime without requiring manual updates or redeployments. Which solution should a Solutions Architect implement to meet these requirements with the least administrative effort?

  1. A
    Store the API key in AWS Systems Manager Parameter Store as a standard String parameter. Configure an Amazon EventBridge rule to trigger a Lambda function every 30 days to update the parameter value.
  2. Store the API key in AWS Secrets Manager. Configure automatic rotation using a custom AWS Lambda rotation function, and configure the application to retrieve the key dynamically at runtime using the AWS SDK.Answer
  3. C
    Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter. Enable automatic rotation on the associated customer managed key in AWS KMS to rotate the API key value every 30 days.
  4. D
    Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store. Write a custom script that re-encrypts the existing parameter value with a new AWS KMS key version every 30 days to update the credential.

Answer

Store the API key in AWS Secrets Manager, configure automatic rotation using a custom AWS Lambda rotation function, and retrieve the key dynamically at runtime using the AWS SDK.
AWS Secrets Manager securely stores the API key encrypted at rest and supports built-in integration with AWS Lambda to orchestrate custom rotation workflows. By fetching the secret dynamically using the AWS SDK, the client application always receives the active credential version without requiring redeployment.

Step-by-Step Solution

1
Store the sensitive credentials.
The third-party API key is saved as a secret in AWS Secrets Manager, ensuring it is encrypted at rest using an AWS KMS key.
AWS Secrets Manager is the recommended service for managing, rotating, and retrieving database credentials, API keys, and other secrets.
2
Configure the rotation mechanism.
An AWS Lambda rotation function is associated with the secret, and a rotation schedule of 30 days is configured.
Since the API key belongs to a third-party gateway, standard RDS rotation templates do not apply, so a custom Lambda function is required to communicate with the external API provider and update the secret.
3
Update the client application code.
The Lambda function uses the AWS SDK to retrieve the secret value dynamically during execution.
Retrieving the secret at runtime ensures that the application always uses the most current API key version without requiring configuration changes or code redeployments when rotation occurs.

Key Concept

AWS Secrets Manager supports native, automated rotation of secrets via custom AWS Lambda functions, enabling secure retrieval of credentials at runtime without application redeployment.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic