Examkin

Question

Difficulty: EasySecrets and Parameter Management

A software developer is configuring a deployment pipeline on AWS and needs to store database connection details. The database hostname is public information, but the database password must be encrypted at rest to comply with company security policies. The password is static and does not need automatic rotation. Which configuration should the developer use to meet these requirements securely and with the lowest cost?

  1. Store the database hostname as a String parameter and the database password as a SecureString parameter in AWS Systems Manager Parameter Store.Answer
  2. B
    Store both the database hostname and the database password as String parameters in AWS Systems Manager Parameter Store.
  3. C
    Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store, and enable AWS KMS automatic key rotation to rotate the database password value annually.
  4. D
    Store the database password in the AWS account root user credentials to ensure maximum security and access control.

Answer

Store the database hostname as a String parameter and the database password as a SecureString parameter in AWS Systems Manager Parameter Store.
The correct option proposes storing the hostname as a String parameter and the password as a SecureString parameter in AWS Systems Manager Parameter Store. This configuration is secure because the password is encrypted at rest using AWS KMS, and it is cost-effective because standard parameters in Systems Manager Parameter Store are free of charge, unlike AWS Secrets Manager which incurs a monthly hosting fee.

Step-by-Step Solution

1
Identify the security requirements for the database credentials and hostnames.
The database password must be encrypted at rest, whereas the database hostname is public and does not require encryption.
This helps determine which configuration values must be protected and which can be stored in plaintext.
2
Analyze the operational requirements and cost constraints.
The password is static, does not require automatic rotation, and the solution must minimize operational costs.
Since automatic rotation is not needed, Systems Manager Parameter Store is a more cost-effective choice than AWS Secrets Manager.
3
Select the appropriate parameter types for Parameter Store.
Use a String parameter for the hostname and a SecureString parameter for the database password.
This satisfies the security requirement for the password while keeping storage costs free by using standard parameters.

Key Concept

Distinguishing between sensitive and non-sensitive configuration data and using appropriate Parameter Store parameter types (String vs. SecureString) to optimize cost and security.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic