Examkin

Question

Difficulty: MediumSecrets and Parameter Management

An application deployed on AWS needs to query a third-party weather forecasting service. The application requires access to two configuration settings: a sensitive API access token that must be rotated automatically every 30 days, and a non-sensitive API endpoint URL that does not change. To minimize costs while maintaining a secure architecture, which of the following configurations should a solutions architect recommend?

  1. Store the API access token in AWS Secrets Manager and configure a custom AWS Lambda function to rotate the token every 30 days. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.Answer
  2. B
    Store both the API access token and the API endpoint URL as String parameters in AWS Systems Manager Parameter Store, and configure Parameter Store to rotate the token parameter automatically every 30 days.
  3. C
    Store the API access token as a SecureString parameter in AWS Systems Manager Parameter Store, and enable automatic rotation of the associated KMS Customer Managed Key (CMK) every 30 days to rotate the token value.
  4. D
    Store the API access token in AWS Systems Manager Parameter Store as a String parameter, and use a custom AWS Lambda function to encrypt the parameter and rotate the backing KMS key every 30 days.

Answer

Store the API access token in AWS Secrets Manager and configure a custom AWS Lambda function to rotate the token every 30 days. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.
The correct configuration uses AWS Secrets Manager for the sensitive API access token because it provides secure encryption and supports automated rotation through custom AWS Lambda functions. To minimize costs, the non-sensitive, static API endpoint URL is stored in AWS Systems Manager Parameter Store as a standard String parameter, which is free of charge.

Step-by-Step Solution

1
Evaluate the sensitivity and rotation requirements for each parameter.
The API access token is sensitive and requires automatic rotation every 30 days. The API endpoint URL is non-sensitive and static.
This determines which AWS service is best suited for each configuration setting based on security, features, and cost.
2
Select the appropriate storage service for the sensitive API token.
AWS Secrets Manager is selected because it encrypts secrets at rest and natively integrates with AWS Lambda to orchestrate custom rotation schedules (e.g., every 30 days) for third-party APIs.
Systems Manager Parameter Store does not natively support automatic rotation of parameters, and storing secrets in plaintext is insecure.
3
Select the appropriate storage service for the non-sensitive endpoint URL.
AWS Systems Manager Parameter Store (using a standard String parameter) is selected.
Standard parameters in Parameter Store are free of charge, making this the most cost-effective choice for non-sensitive, static configuration settings, whereas storing it in Secrets Manager would incur unnecessary costs.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic