Examkin

Question

Difficulty: MediumSecrets and Parameter Management

An enterprise application running on Amazon Elastic Kubernetes Service (EKS) requires access to two configuration settings: a database connection port (33063306) and a highly sensitive database password. The database password must be automatically rotated every 3030 days. The solutions architect must design a secure and cost-optimized solution that stores these parameters and supports the rotation requirement.

Which configuration management strategy should the solutions architect recommend?

  1. A
    Store both the database port and the database password as String parameters in AWS Systems Manager Parameter Store, and restrict access using IAM policies to ensure security while minimizing cost.
  2. B
    Store the database port as a String parameter in AWS Systems Manager Parameter Store. Store the database password as a SecureString parameter in Parameter Store, and enable automatic key rotation on the associated AWS KMS customer managed key to rotate the password value every 3030 days.
  3. Store the database port as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation for the secret.Answer
  4. D
    Store the database port in AWS Secrets Manager. Store the database password as a String parameter in AWS Systems Manager Parameter Store, and configure a custom AWS Lambda function to handle parameter rotation.

Answer

Store the database port as a String parameter in AWS Systems Manager Parameter Store, and store the database password in AWS Secrets Manager with automatic rotation configured.
Storing the non-sensitive database port as a String parameter in AWS Systems Manager Parameter Store is cost-effective because Standard parameters are free. AWS Secrets Manager is designed to secure sensitive credentials like database passwords and natively supports automatic credential rotation. This combination provides a secure and cost-optimized architecture that meets the rotation requirement.

Step-by-Step Solution

1
Analyze the security and rotation requirements for both configuration settings.
The database port (33063306) is non-sensitive and does not require encryption or rotation. The database password is highly sensitive and requires automatic rotation every 3030 days.
Separating parameters by security classification allows for a cost-effective design.
2
Select the storage mechanism for the non-sensitive configuration parameter.
Store the port as a standard String parameter in Systems Manager Parameter Store.
Standard parameters in Parameter Store are free of charge, minimizing operational costs for non-sensitive data.
3
Select the storage and rotation mechanism for the sensitive database credential.
Store the database password in AWS Secrets Manager and configure automatic rotation.
Secrets Manager provides native integration for rotating database credentials automatically, satisfying the compliance requirement securely.

Key Concept

Selecting and configuring secure storage and automatic rotation mechanisms for sensitive and non-sensitive configurations using Parameter Store and Secrets Manager.
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameter Management

More questions from this topic