Examkin

Question

Difficulty: Very hardSecrets and Parameters Management

A company has a production database in the us-east-1 region. Applications running in both the us-east-1 and us-west-2 regions connect to this database. The database credentials are stored in a primary secret in AWS Secrets Manager in the us-east-1 region and are replicated to the us-west-2 region. A SysOps administrator must configure automatic credential rotation every 30 days without causing application downtime in either region.

Which steps should the SysOps administrator take to meet these requirements? (Select TWO.)

  1. Configure the automatic rotation schedule and associate the rotation AWS Lambda function on the primary secret in the us-east-1 region.Answer
  2. Configure the database credentials to use a multi-user rotation strategy with two database users, so one user remains active while the other is rotated.Answer
  3. C
    Configure separate automatic rotation schedules and rotation AWS Lambda functions on both the primary secret in the us-east-1 region and the replica secret in the us-west-2 region.
  4. D
    Configure the rotation AWS Lambda function in the us-east-1 region to make cross-region API calls to update the replicated secret in the us-west-2 region after updating the primary secret.
  5. E
    Configure the primary secret to use a single-user rotation strategy and increase the local application cache expiration time in the us-west-2 region to match the rotation window.

Answer

Configure the automatic rotation schedule and associate the rotation AWS Lambda function on the primary secret in the us-east-1 region, and configure the database credentials to use a multi-user rotation strategy with two database users.
To configure automatic secret rotation without downtime in a replicated multi-region architecture, the rotation must be configured only on the primary secret in the us-east-1 region. Secrets Manager automatically handles the propagation of the new secret value to the replica in the us-west-2 region. Furthermore, a multi-user rotation strategy must be used. By maintaining two users (active and standby), the rotation function updates the password for the standby user and updates the secret. The active user's credentials remain valid until the next rotation, ensuring that applications using cached credentials can continue to connect to the database without interruption.

Step-by-Step Solution

1
Determine the correct target for configuring secret rotation in a replicated scenario.
Identify that automatic rotation must be configured on the primary secret in the us-east-1 region.
Replica secrets in secondary regions are read-only and automatically updated by AWS Secrets Manager when the primary secret is rotated.
2
Select a rotation strategy that prevents downtime for database connections.
Choose the multi-user rotation strategy over the single-user rotation strategy.
The multi-user strategy updates a standby database user's credentials while keeping the active user's credentials valid. This prevents application instances from failing to connect due to out-of-sync cached credentials during the rotation window.
3
Implement the configuration on the primary secret.
Configure the rotation schedule and link the AWS Lambda rotation function to the primary secret in us-east-1.
This initiates the rotation sequence which updates the database, updates the primary secret, and automatically replicates the new secret value to us-west-2.

Key Concept

AWS Secrets Manager replica secrets are read-only and automatically synchronized with the primary secret. In order to rotate database credentials without causing downtime, a multi-user rotation strategy must be used, and the rotation must be configured on the primary secret in the source region.
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic