Examkin

Question

Difficulty: Very hardSecrets and Parameter Management

An enterprise is designing a secure architecture for a microservices application. The application's compute resources run in an Amazon ECS cluster hosted in AWS Account A, while the backend Amazon Aurora PostgreSQL database is hosted in AWS Account B. The security architecture must satisfy the following constraints:
1. The database credentials must be encrypted at rest and automatically rotated every 30 days without manual intervention.
2. The application requires access to a third-party payment API token that must be encrypted at rest and rotated every 90 days.
3. Non-sensitive configurations (such as the database endpoint and port) must be stored in a cost-optimized manner and accessible without decryption overhead.
4. The ECS tasks in Account A must access these resources securely with minimal operational complexity.

Which two options should the solutions architect choose to meet these requirements?

  1. Store the database credentials in AWS Secrets Manager in Account B, encrypted with a customer managed KMS key. Enable automatic rotation using the built-in Aurora PostgreSQL rotation template, and attach a resource-based policy to the secret to grant read access to the ECS task execution role in Account A.Answer
  2. Store the non-sensitive database configurations as standard String parameters in AWS Systems Manager Parameter Store in Account A, and store the third-party API token in AWS Secrets Manager in Account A with a custom AWS Lambda function configured for its 90-day rotation.Answer
  3. C
    Store the database credentials and the third-party API token in AWS Systems Manager Parameter Store in Account B as String parameters, and use AWS KMS automatic key rotation to automatically update the credentials in the database and re-encrypt the parameter values.
  4. D
    Store the database credentials and non-sensitive configurations in AWS Systems Manager Parameter Store in Account B as SecureString parameters, and configure the ECS tasks in Account A to retrieve them directly using a resource-based policy attached to the parameters.
  5. E
    Store the third-party API token in AWS Systems Manager Parameter Store in Account A as a String parameter, and configure an Amazon EventBridge rule that triggers a custom AWS Lambda function to rotate the token and update the parameter value every 90 days.

Answer

Store the database credentials in AWS Secrets Manager in Account B with a resource-based policy and built-in rotation template. Store the non-sensitive configurations in AWS Systems Manager Parameter Store in Account A as standard String parameters, and store the third-party API token in AWS Secrets Manager in Account A using a custom Lambda function for rotation.
For the database credentials in Account B, AWS Secrets Manager is the optimal choice because it supports native database password rotation and resource-based policies, allowing direct cross-account access from Account A's ECS task role. For the non-sensitive parameters, Systems Manager Parameter Store standard String parameters provide a free, no-decryption-overhead solution within Account A. For the third-party API key, Secrets Manager in Account A allows custom 90-day rotation via AWS Lambda while maintaining encryption at rest.

Step-by-Step Solution

1
Select the database credentials storage and cross-account access strategy.
Database credentials should be stored in AWS Secrets Manager in Account B.
Secrets Manager natively supports automatic 30-day rotation for RDS/Aurora using built-in Lambda templates. It also supports resource-based policies, which allow ECS tasks in Account A to read the secret directly across accounts.
2
Select the storage strategy for non-sensitive configurations to minimize cost and latency.
Store non-sensitive configurations as standard String parameters in Systems Manager Parameter Store in Account A.
Standard String parameters in Parameter Store do not incur storage or decryption costs, and since they are stored in the same account as the ECS tasks, no cross-account access overhead is introduced.
3
Select the storage and rotation strategy for the third-party API token.
Store the third-party API token in AWS Secrets Manager in Account A, using a custom AWS Lambda function for rotation.
The API token requires encryption at rest (achieved via Secrets Manager) and a custom rotation mechanism since it is an external third-party API. Secrets Manager integrates directly with Lambda to schedule and execute this rotation logic.

Key Concept

Cross-account access and automated lifecycle management of sensitive credentials and non-sensitive configurations using AWS Secrets Manager and Systems Manager Parameter Store.
Estimated Time:3m 0s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic