Examkin

Question

Difficulty: EasySecrets and Parameters Management

A SysOps administrator needs to configure automatic rotation for database credentials stored in AWS Secrets Manager. What must the administrator configure to execute the rotation code and update the credentials in both Secrets Manager and the database?

  1. An AWS Lambda function with the appropriate execution role and database connectivityAnswer
  2. B
    An IAM service role attached directly to the database instance that queries Secrets Manager
  3. C
    An Amazon EventBridge rule that directly updates the database user credentials using the Amazon RDS API
  4. D
    An AWS Systems Manager patch baseline configured to run updates on the database instance operating system

Answer

An AWS Lambda function with the appropriate execution role and database connectivity
The correct answer is the option specifying an AWS Lambda function with the appropriate execution role and database connectivity. AWS Secrets Manager relies on Lambda to execute rotation templates (or custom code) that connect to the database to alter the credentials, and then call Secrets Manager to complete the rotation lifecycle.

Step-by-Step Solution

1
Identify the compute component required by AWS Secrets Manager to perform secret rotation.
AWS Secrets Manager triggers an AWS Lambda function to run the rotation logic.
Secrets Manager cannot log into databases directly to run SQL commands; it delegates this execution to a Lambda function.
2
Determine the network and permission requirements for the Lambda function.
The Lambda function must be configured to access the database's network (typically inside a VPC) and have IAM permissions to update Secrets Manager.
The function must establish a network connection to change the database user password and invoke the Secrets Manager API to store the new password.

Key Concept

AWS Secrets Manager automates secret rotation by executing an AWS Lambda function that updates the credential at the target service and records the change in the secret.
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic