Examkin

Question

Difficulty: MediumSecrets and Parameter Management

A company is deploying a retail application on Amazon EC2 instances. The application requires access to database credentials for an Amazon RDS for MySQL database, which must be rotated automatically every 30 days to comply with security standards. Additionally, the application requires access to a static API key for an external payment gateway provider. This API key must be encrypted at rest but does not require rotation. The company wants to minimize ongoing management costs for storing these credentials. Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager, and configure automatic rotation using a built-in rotation template with an AWS Lambda function.Answer
  2. Store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store.Answer
  3. C
    Store the payment gateway API key as a String parameter in AWS Systems Manager Parameter Store to avoid KMS encryption charges.
  4. D
    Store the database credentials in AWS Secrets Manager, and enable automatic key rotation on the associated AWS KMS Customer Managed Key to rotate the database password.
  5. E
    Store both the database credentials and the payment gateway API key as String parameters in AWS Systems Manager Parameter Store to eliminate storage costs.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function, and store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store.
The database credentials require automatic rotation, which is natively supported by AWS Secrets Manager using Lambda functions. The payment gateway API key is static, so it does not need rotation, and storing it as a SecureString parameter in AWS Systems Manager Parameter Store encrypts the data at rest using AWS KMS while avoiding the monthly per-secret cost of AWS Secrets Manager.

Step-by-Step Solution

1
Identify the rotation and encryption requirements for each sensitive data item.
The database credentials require regular 30-day rotation, while the payment gateway API key is static but must be encrypted.
This determines which AWS service features are necessary (e.g., automatic rotation capabilities vs. static secure storage).
2
Select the appropriate storage service for the database credentials.
Choose AWS Secrets Manager with a Lambda rotation function.
AWS Secrets Manager provides built-in integration with Lambda to automatically rotate database credentials without manual intervention.
3
Select the cost-optimized secure storage service for the static API key.
Choose AWS Systems Manager Parameter Store with the SecureString parameter type.
Parameter Store SecureString provides KMS-encrypted storage with no additional storage fees for standard parameters, making it highly cost-effective for static secrets that do not require rotation.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on credential rotation and cost-optimization requirements.
Estimated Time:2m 0s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic