Examkin

Question

Difficulty: Very hardSecrets and Parameter Management

A financial technology company operates a transaction processing application deployed across two AWS Regions: us-east-1 and us-west-2. The application requires access to a third-party payment gateway API key that must be rotated every 30 days. To comply with security mandates, the key must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the KMS CMK itself must be rotated annually. The solution must ensure that client applications in both Regions can retrieve the active API key with latency under 50 ms50\text{ ms} and experience no service interruptions during both API key rotation and KMS key rotation. Which architecture should a solutions architect recommend to meet these requirements with the least operational overhead?

  1. A
    Create a secret in AWS Secrets Manager in us-east-1 with replication to us-west-2. Use a Customer Managed Key (CMK) to encrypt the secret. Configure automated rotation every 30 days using a custom AWS Lambda function. Enable annual rotation on the KMS CMK, and configure the Lambda function to re-encrypt all historical secret versions using the new KMS key version immediately after KMS key rotation occurs.
  2. B
    Create a Systems Manager Parameter Store parameter of type String in both us-east-1 and us-west-2. Configure an AWS Lambda function triggered by an Amazon EventBridge scheduled event to update the parameter value in both Regions every 30 days. Configure the Customer Managed Key (CMK) used to encrypt the parameters to rotate automatically every year.
  3. Create a secret in AWS Secrets Manager in us-east-1 and enable multi-Region replication to us-west-2. Configure the secret to use a Customer Managed Key (CMK) in each Region. Enable Secrets Manager automatic rotation every 30 days using a custom AWS Lambda function, and enable automatic key rotation on both KMS CMKs. Configure the application in each Region to read the secret from the local Secrets Manager endpoint.Answer
  4. D
    Create a Systems Manager Parameter Store parameter of type SecureString in us-east-1. Configure a custom AWS Lambda function triggered by an Amazon EventBridge scheduled event to replicate the parameter value to us-west-2 and manually rotate the KMS Customer Managed Key (CMK) material every 30 days to keep the parameter and KMS key versions synchronized.

Answer

Create a secret in AWS Secrets Manager in us-east-1 and enable multi-Region replication to us-west-2. Configure the secret to use a Customer Managed Key (CMK) in each Region. Enable Secrets Manager automatic rotation every 30 days using a custom AWS Lambda function, and enable automatic key rotation on both KMS CMKs. Configure the application in each Region to read the secret from the local Secrets Manager endpoint.
The correct architecture uses AWS Secrets Manager's native multi-Region replication to copy the secret to the secondary Region, allowing local applications to retrieve the secret with minimal latency. Encryption is handled using a Customer Managed Key (CMK) in each Region. Configuring automatic rotation via a custom Lambda function ensures the third-party credential is rotated every 30 days, and enabling automatic KMS CMK rotation ensures that key rotation occurs seamlessly without needing manual re-encryption or causing application downtime.

Step-by-Step Solution

1
Select AWS Secrets Manager for storing the sensitive API key rather than AWS Systems Manager Parameter Store.
Secrets Manager is chosen because it supports native multi-Region replication and automated rotation out-of-the-box, which aligns with the requirements of minimal latency (< 50 ms via local endpoints) and low operational overhead.
Systems Manager Parameter Store lacks native cross-Region replication and automated rotation features for third-party keys.
2
Configure multi-Region replication for the secret from us-east-1 to us-west-2 using local KMS CMKs in each Region.
The secret is automatically replicated and re-encrypted in us-west-2 using the destination Region's KMS CMK.
This guarantees that application instances in both Regions can query their local Secrets Manager endpoint to retrieve the secret with low latency.
3
Implement a custom AWS Lambda function to rotate the third-party API credential every 30 days, and configure Secrets Manager to trigger it.
Secrets Manager manages the execution of the Lambda function to update the secret value and propagates the updated secret to the replica Region.
Since the API key belongs to a third-party gateway, a custom Lambda function is necessary to call the gateway's API to obtain a new key and update the secret value.
4
Enable automatic annual key rotation on the KMS Customer Managed Keys in both Regions.
AWS KMS generates a new backing key annually while retaining the old backing key to decrypt any historical ciphertext.
This ensures that older secret versions can still be decrypted seamlessly without requiring manual re-encryption or causing application downtime.

Key Concept

AWS Secrets Manager multi-Region replication combined with custom rotation Lambda functions and AWS KMS automatic key rotation mechanics.
Estimated Time:3m 0s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic