Examkin

Question

Difficulty: EasySecrets and Parameters Management

A SysOps administrator has configured automatic rotation for a database credential stored in AWS Secrets Manager. During the first scheduled rotation, the administrator notices that the rotation status changes to failed, and the database credentials are not updated. Which of the following is the most likely cause of this rotation failure?

  1. A
    The database instance is missing an IAM service role that grants access to decrypt the secret using the customer managed KMS key.
  2. B
    The administrator's IAM policy is missing the iam:PassRole permission required to associate the rotation role with the database.
  3. The AWS Lambda rotation function cannot network-communicate with the database endpoint to update the credentials.Answer
  4. D
    The Systems Manager Automation document lacks an EventBridge trigger to schedule the secret rotation.

Answer

The AWS Lambda rotation function cannot network-communicate with the database endpoint to update the credentials.
For AWS Secrets Manager to rotate a database credential, it runs an AWS Lambda rotation function that connects to the database to update the password. If the Lambda function cannot establish a network connection to the database (e.g., due to VPC security groups, network access control lists, or routing rules), the rotation process fails.

Step-by-Step Solution

1
Analyze how AWS Secrets Manager rotates credentials.
Secrets Manager invokes a Lambda rotation function to update the credentials in the database.
Understanding the rotation architecture helps isolate the components involved in the failure.
2
Determine the network requirements for the Lambda rotation function.
The Lambda function must have network access to the database endpoint (e.g., inside a VPC) and the database must accept connections from the Lambda function's security group.
Since the Lambda function needs to log in and change the password, a network path must exist between the function and the database.
3
Identify the root cause of the rotation failure.
A lack of network connectivity prevents the Lambda function from reaching the database, causing the rotation to fail.
This direct network communication is a prerequisite for a successful rotation.

Key Concept

Secrets Manager automatic rotation requires a Lambda rotation function that has both the correct database access permissions and direct network connectivity to the target database endpoint.
Estimated Time:1m 0s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic