Examkin

Question

Difficulty: Very hardSecrets and Parameter Management

An enterprise architecture consists of a primary production workload running on Amazon ECS in the us-east-1 region, and a testing suite running in a secondary development AWS account. The production ECS tasks must connect to a Multi-AZ Amazon Aurora PostgreSQL database. The security policy mandates that database credentials must be rotated every 30 days without application downtime, and all sensitive data at rest must be encrypted using a customer managed key (CMK). Additionally, a non-sensitive configuration file containing public API endpoints must be shared with the testing suite in the development account. The operations team wants to implement these requirements while minimizing ongoing AWS costs and administrative overhead. Which design meets these requirements?

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation every 30 days using the AWS-provided rotation Lambda function. Encrypt the secret using a KMS customer managed key (CMK). Store the non-sensitive public API endpoints as standard String parameters in Systems Manager Parameter Store, and allow the development account to access them by assuming a cross-account IAM role in the production account.Answer
  2. B
    Store the database credentials as SecureString parameters in Systems Manager Parameter Store. Configure AWS KMS to automatically rotate the customer managed key (CMK) every 30 days, which will rotate the underlying database password. Store the public API endpoints as String parameters in Parameter Store, and apply a resource-based policy to share them with the development account.
  3. C
    Store both the database credentials and the public API endpoints as standard String parameters in Systems Manager Parameter Store to eliminate Secrets Manager costs. Create an Amazon EventBridge rule that runs every 30 days to trigger a custom AWS Lambda function that rotates the database credentials and updates the Parameter Store values.
  4. D
    Store the database credentials in AWS Secrets Manager and the public API endpoints in AWS Secrets Manager. Enable automatic rotation on the KMS customer managed key (CMK) encrypting the database credentials secret, which will automatically rotate the database password in RDS and re-encrypt all historical database backups under the new key version.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation enabled using the AWS-provided rotation Lambda function, and encrypt them with a KMS customer managed key (CMK). Store the non-sensitive public API endpoints as standard String parameters in Systems Manager Parameter Store, and share them with the development account using a cross-account IAM role.
The correct solution uses AWS Secrets Manager for the database credentials, which supports native, automated rotation via Lambda for Aurora PostgreSQL and integrates with KMS for encryption at rest. For the non-sensitive public API endpoints, using Systems Manager Parameter Store standard String parameters is the most cost-effective approach since standard parameters are free. Since Parameter Store does not support resource-based policies, sharing them with the development account is securely accomplished by having the development account assume a cross-account IAM role.

Step-by-Step Solution

1
Select the appropriate storage for database credentials.
Database credentials must be stored in AWS Secrets Manager to support automated rotation using the built-in RDS/Aurora rotation Lambda templates.
Systems Manager Parameter Store does not natively support automated database credential rotation templates, and using Secrets Manager meets the 30-day rotation security requirement with minimal operational overhead.
2
Ensure encryption of the sensitive credentials.
Encrypt the Secrets Manager secret using an AWS KMS customer managed key (CMK) to comply with the encryption at rest mandate.
Customer managed keys provide granular control over key rotation and access policies.
3
Optimize costs for non-sensitive data and share it cross-account.
Store public API endpoints as standard String parameters in Systems Manager Parameter Store, and allow cross-account access by assuming an IAM role.
Standard String parameters in Systems Manager Parameter Store are free, avoiding the cost of storing non-sensitive data in Secrets Manager. Since Parameter Store does not support resource-based policies, a cross-account IAM role in the production account must be assumed by the dev account.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on rotation capabilities, cost optimization, and cross-account access mechanisms.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic