Examkin

Question

Difficulty: MediumData Encryption and Key Management

An organization is deploying a microservices-based application on Amazon ECS. The services require access to a third-party payment gateway API token. The security policy dictates that the API token must be stored securely, encrypted at rest, and automatically rotated every 30 days to mitigate credential exposure risks.

Which solution should a solutions architect recommend to satisfy these requirements with the least operational overhead?

  1. Store the API token in AWS Secrets Manager. Configure automatic rotation using a custom or template AWS Lambda function on a 30-day schedule, and update the ECS tasks to retrieve the token dynamically.Answer
  2. B
    Store the API token in AWS Systems Manager Parameter Store as a standard String parameter. Configure an Amazon EventBridge rule and an AWS Lambda function to update the parameter value every 30 days.
  3. C
    Store the API token in AWS Systems Manager Parameter Store as a SecureString parameter, and enable the native automatic 30-day key rotation option directly in the Parameter Store console.
  4. D
    Store the API token in an Amazon S3 bucket encrypted with an AWS KMS Customer Managed Key. Enable automatic annual rotation on the KMS key to rotate the API token every 30 days.

Answer

Store the API token in AWS Secrets Manager, configure automatic rotation using an AWS Lambda function, and retrieve it dynamically within the ECS tasks.
Storing the API token in AWS Secrets Manager is the correct approach because Secrets Manager is designed specifically for managing secrets and natively integrates with AWS Lambda to rotate credentials automatically. It encrypts secrets at rest using AWS KMS and allows ECS tasks to retrieve the values dynamically via IAM roles, ensuring security and low operational overhead.

Step-by-Step Solution

1
Identify the primary requirement for storing sensitive data (an API token) securely with automatic rotation and minimal operational overhead.
Secrets must be encrypted at rest, and the storage service should ideally have built-in support for scheduled rotation.
This narrows down the service choices to those supporting encryption and rotation, such as AWS Secrets Manager.
2
Compare AWS Secrets Manager and AWS Systems Manager Parameter Store.
AWS Secrets Manager natively supports automatic rotation using AWS Lambda out-of-the-box. Systems Manager Parameter Store supports encryption (SecureString) but does not have a built-in rotation scheduler or lifecycle management for parameters.
Using Secrets Manager minimizes operational overhead since you do not need to build and maintain custom orchestrators for rotation.
3
Evaluate the S3 and KMS key rotation options.
KMS key rotation only rotates the KMS key material; it does not rotate application-level secrets or files stored in S3.
This eliminates options that confuse KMS key rotation with secret credential rotation.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for Secret Rotation
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic