Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A company is deploying a new web application using AWS App Runner. The application requires access to a database connection string containing sensitive credentials that must be automatically rotated every 30 days. The application also needs access to a database port configuration, which is non-sensitive and static. The company wants to implement a secure solution that minimizes cost and management overhead. Which configuration meets these requirements?

  1. A
    Store both the database connection string and the database port as standard String parameters in AWS Systems Manager Parameter Store. Configure an Amazon EventBridge cron rule to trigger an AWS Lambda function that updates the parameters every 30 days.
  2. Store the database connection string in AWS Secrets Manager and configure automatic rotation every 30 days using an AWS Lambda function. Store the database port as a String parameter in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store. Enable automatic annual rotation on the AWS KMS key used to encrypt the parameter to rotate the credentials every 30 days.
  4. D
    Store the database connection string as a String parameter in AWS Systems Manager Parameter Store. Configure the application to decrypt the string using a hardcoded key stored in the application configuration.

Answer

Store the database connection string in AWS Secrets Manager with automatic rotation configured via an AWS Lambda function, and store the database port as a standard String parameter in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive credentials and natively supports automatic rotation using AWS Lambda functions, which aligns with the security requirements. For non-sensitive configurations such as the database port, AWS Systems Manager Parameter Store standard String parameters are the most cost-effective choice since they are free of charge, thus minimizing overall cloud architecture costs.

Step-by-Step Solution

1
Identify the sensitivity and rotation requirements of the database connection string.
The connection string contains sensitive credentials and requires automatic rotation every 30 days.
This determines that AWS Secrets Manager is the appropriate service, as it natively supports scheduled credential rotation using AWS Lambda.
2
Identify the sensitivity and rotation requirements of the database port.
The port is static and non-sensitive.
This allows the port to be stored in AWS Systems Manager Parameter Store as a standard String parameter, which is free and avoids the cost of Secrets Manager.
3
Configure the web application on AWS App Runner to reference these configurations.
App Runner service is configured to retrieve the credentials from Secrets Manager and the port from Parameter Store.
This integration secures the secrets and configuration parameters during application startup without hardcoding values in the container.

Key Concept

Secrets and Parameter Management
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic