Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A company is deploying an IoT data processing application on Amazon ECS using the Fargate launch type. The application needs to retrieve two configuration values: a database endpoint address that does not contain sensitive information, and an API password for an external service that must be rotated every 60 days. The solutions architect wants to implement a secure solution that minimizes ongoing operational costs.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store.Answer
  2. Store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.Answer
  3. C
    Store the database endpoint address in AWS Secrets Manager and enable the default automatic rotation feature.
  4. D
    Store the API password as a String parameter in AWS Systems Manager Parameter Store.
  5. E
    Configure automatic key rotation on the AWS Key Management Service (AWS KMS) customer managed key to automatically rotate the API password value every 60 days.

Answer

Store the database endpoint address as a String parameter in AWS Systems Manager Parameter Store, and store the API password in AWS Secrets Manager and configure an AWS Lambda function to rotate the secret every 60 days.
The database endpoint is non-sensitive configuration data, meaning it can be stored cost-effectively as a String parameter in AWS Systems Manager Parameter Store without incurring extra charges. The API password, being sensitive and requiring automated rotation every 60 days, must be stored in AWS Secrets Manager. Secrets Manager natively supports automated rotation schedules and can trigger a custom AWS Lambda function to update the credential on the third-party service.

Step-by-Step Solution

1
Evaluate the sensitivity of the database endpoint and the API password.
Identify that the database endpoint is non-sensitive configuration data, while the API password is a highly sensitive credential.
Determining data sensitivity helps choose the most cost-effective and secure storage service.
2
Select the storage service for the non-sensitive database endpoint.
Store the endpoint in AWS Systems Manager Parameter Store as a String parameter.
Parameter Store standard parameters are free of charge, which satisfies the cost minimization requirement for non-sensitive configuration.
3
Select the storage service and rotation method for the sensitive API password.
Store the API password in AWS Secrets Manager and configure a custom AWS Lambda function for rotation.
AWS Secrets Manager supports encrypted storage and automated rotation, using Lambda to run custom rotation code for third-party APIs.

Key Concept

Secrets and Parameter Management
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic