Examkin

Question

Difficulty: EasySecrets and Parameter Management

An organization's software application requires access to two configurations: a static partner API token that does not change, and a backend database password that must rotate automatically every 45 days. The organization wants a cost-effective solution that keeps both secrets encrypted at rest. Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and configure automatic rotation.Answer
  2. Store the static partner API token as a SecureString parameter in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the database password as a String parameter in AWS Systems Manager Parameter Store.
  4. D
    Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store and enable automatic rotation on the default aws/ssm KMS key.
  5. E
    Store the static partner API token as a String parameter in AWS Systems Manager Parameter Store and restrict access using a custom IAM policy.

Answer

Store the database password in AWS Secrets Manager and configure automatic rotation, and store the static partner API token as a SecureString parameter in AWS Systems Manager Parameter Store.
AWS Secrets Manager is ideal for credentials that require lifecycle management and automatic rotation. Storing the static partner API token as a SecureString parameter in AWS Systems Manager Parameter Store is the most cost-effective and secure method for static secrets that do not require rotation.

Step-by-Step Solution

1
Analyze the requirements for the static partner API token.
The token is static, does not require automatic rotation, but must be encrypted at rest. Standard parameters of type SecureString in AWS Systems Manager Parameter Store provide free, secure, encrypted storage.
Parameter Store is more cost-effective than AWS Secrets Manager for secrets that do not require rotation.
2
Analyze the requirements for the database password.
The password requires automatic rotation every 45 days. AWS Secrets Manager natively integrates with AWS Lambda to rotate credentials automatically.
AWS Systems Manager Parameter Store does not natively support automatic rotation of secrets, making AWS Secrets Manager the correct choice for this requirement.

Key Concept

Choosing between AWS Secrets Manager and AWS Systems Manager Parameter Store based on rotation requirements and cost.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic