Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

An organization is designing a serverless data processing application. AWS Lambda functions in the application must securely access a database password to connect to an Amazon RDS database. The database credentials must be rotated every 30 days without application downtime. Additionally, an external compliance auditor requires temporary, read-only access to the Amazon S3 bucket where the processed output files are stored.

Which combination of actions should the solutions architect take to meet these requirements securely? (Select TWO.)

  1. Configure AWS Secrets Manager to store the database credentials, enable automatic rotation every 30 days using a rotation Lambda function, and grant the Lambda execution role permissions to retrieve the secret.Answer
  2. Create an IAM role in the processing account that grants read-only access to the S3 bucket, configure a trust policy that allows the auditor's AWS account to assume the role, and provide the auditor with the role ARN.Answer
  3. C
    Store the database credentials as a standard String parameter in AWS Systems Manager Parameter Store, and schedule a custom Lambda function to update the parameter value every 30 days.
  4. D
    Create an IAM user in the AWS account for the external auditor, attach an IAM policy for S3 read-only access, and provide the auditor with the access key ID and secret access key.
  5. E
    Configure the Lambda functions to run using the AWS account root user credentials to ensure they have administrative permissions to rotate the database passwords and manage the S3 bucket policies.

Answer

Configure AWS Secrets Manager to store database credentials with automatic rotation, and create a cross-account IAM role with a trust policy for the external auditor.
The correct architecture uses AWS Secrets Manager to store and rotate database passwords dynamically, which keeps credentials secure and satisfies the rotation requirement. To grant secure cross-account access to the external auditor, creating an IAM role with a trust policy allowing the auditor's account to assume it is the standard and most secure pattern because it provides temporary credentials instead of long-term access keys.

Step-by-Step Solution

1
Store the sensitive database credentials securely in AWS Secrets Manager and set up automatic 30-day rotation using the built-in integration with AWS Lambda.
The database credentials are encrypted at rest, rotated automatically without manual intervention or downtime, and can be retrieved dynamically by the application.
This meets the security requirement for credential rotation and protects the credentials from exposure.
2
Configure the Lambda execution role with permissions to access the specific secret from Secrets Manager.
The Lambda function can authenticate to the database securely at runtime without hardcoding credentials.
This enforces the principle of least privilege by restricting access to only the authorized resource.
3
Establish a cross-account IAM role in the local AWS account that has read-only access to the S3 bucket, and define a trust policy referencing the external auditor's AWS account ID.
The external auditor can assume the role to receive temporary security credentials for S3 access.
This avoids creating long-term IAM users or sharing permanent credentials with external third parties.

Key Concept

AWS IAM identity federation, cross-account access via roles, and secure secrets management with rotation.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic