Examkin

Question

Difficulty: Very hardSecrets and Parameter Management

An enterprise-grade media streaming platform is deploying a new content analytics service. The service consists of containerized microservices running on AWS Fargate in a private subnet. The application requires access to two distinct items: a non-sensitive database configuration string that changes per environment, and a highly sensitive API token used to authenticate with an external content delivery network (CDN) partner. The database configuration must be retrieved with low latency and without incurring additional request fees. The CDN API token must be encrypted at rest, rotated automatically every 30 days via a custom rotation schedule, and must never be exposed as plaintext in the Fargate task definition or console.

Which combination of actions should a solutions architect take to meet these requirements securely and cost-effectively? (Select TWO.)

  1. Store the database configuration string as a standard String parameter in AWS Systems Manager Parameter Store, and reference its Amazon Resource Name (ARN) in the ECS container definition using the valueFrom parameter to inject it as an environment variable.Answer
  2. Store the CDN API token in AWS Secrets Manager, configure a rotation schedule that runs a custom AWS Lambda function every 30 days, and grant the ECS task execution role permission to decrypt the secret using a Customer Managed Key.Answer
  3. C
    Store the CDN API token as a standard String parameter in AWS Systems Manager Parameter Store to avoid additional storage costs, and configure an Amazon EventBridge scheduled rule to update the parameter value via a Lambda function every 30 days.
  4. D
    Store the CDN API token in AWS Secrets Manager, encrypt it using the AWS managed key aws/secretsmanager, and enable automatic key rotation on the KMS key to rotate the CDN API token value every 30 days.
  5. E
    Store the database configuration string in AWS Secrets Manager, and store the CDN API token in AWS Systems Manager Parameter Store as a SecureString parameter using the native Parameter Store automatic rotation policy.

Answer

To securely and cost-effectively manage these parameters, the solutions architect should store the non-sensitive database configuration string as a standard String parameter in Systems Manager Parameter Store and reference it in the task definition, while storing the sensitive CDN API token in Secrets Manager with automatic Lambda-based rotation and KMS decryption permissions granted to the task execution role.
The correct solution uses AWS Systems Manager Parameter Store Standard parameters for non-sensitive data (database configuration) because standard parameters are free and have no request costs. For sensitive credentials that require automatic rotation (CDN API token), the solution uses AWS Secrets Manager. Secrets Manager integrates directly with AWS Lambda for custom rotation functions. The containerized Fargate task securely accesses both via environment variables injected at runtime, using the task execution role with appropriate decrypt permissions.

Step-by-Step Solution

1
Analyze credential security and rotation requirements.
Identify that the CDN API token is highly sensitive and requires automatic rotation every 30 days, which aligns with AWS Secrets Manager capabilities.
Secrets Manager provides native lifecycle management and Lambda integration for custom rotation schedules.
2
Analyze configuration cost and latency requirements.
Identify that the database configuration string is non-sensitive and must be retrieved without request fees.
Systems Manager Parameter Store Standard parameters are free and ideal for non-sensitive configuration data.
3
Configure integration with AWS Fargate tasks.
Reference the Parameter Store parameter and Secrets Manager secret in the ECS container definition using the task execution role.
This prevents hardcoding credentials or configurations inside the container image or task definitions.

Key Concept

Distinguishing between AWS Secrets Manager for automated secret lifecycle management and AWS Systems Manager Parameter Store for cost-effective configuration management, while understanding the limits of KMS key rotation versus secret rotation.
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic