Examkin

Question

Difficulty: MediumSecrets and Parameters Management

A SysOps administrator is managing configuration parameters in AWS Systems Manager Parameter Store. To satisfy a security compliance requirement, a sensitive configuration parameter must be updated at least once every 9090 days. If the parameter is not updated within this period, the operations team must receive a notification. If the parameter remains unmodified after 120120 days, it must be automatically deleted to prevent the use of stale configurations.

Which combination of actions should the SysOps administrator take to meet these requirements? (Select TWO.)

  1. Apply a parameter policy to the parameter that includes a NoChangeNotification policy set to 9090 days and an Expiration policy set to 120120 days.Answer
  2. Create an Amazon EventBridge rule that filters for Systems Manager Parameter Store parameter policy events and sends notifications to an Amazon Simple Notification Service (Amazon SNS) topic.Answer
  3. C
    Configure an AWS Key Management Service (AWS KMS) key policy on the key used to encrypt the parameter to automatically deny decrypt permissions to the application after 9090 days.
  4. D
    Configure automatic rotation for the parameter in AWS Secrets Manager, setting the rotation interval to 9090 days and defining a Lambda function to delete the secret after 120120 days.
  5. E
    Create an AWS Config rule to monitor the parameter compliance and trigger an AWS Systems Manager Automation runbook to delete the parameter if it is not updated within 120120 days.

Answer

To meet the requirements, the SysOps administrator should apply a parameter policy containing both a NoChangeNotification policy set to 90 days and an Expiration policy set to 120 days, and create an Amazon EventBridge rule to route the parameter policy events to an Amazon SNS topic.
Applying a parameter policy containing both a NoChangeNotification type (for the 90-day alert) and an Expiration type (for the 120-day deletion) enables the native enforcement of parameter lifecycles. Creating an Amazon EventBridge rule that detects Parameter Store policy actions and routes them to an Amazon SNS topic ensures that the operations team receives alerts when the 90-day no-change limit is reached.

Step-by-Step Solution

1
Define parameter policies for Systems Manager Parameter Store.
The parameter is configured with a NoChangeNotification policy of 90 days and an Expiration policy of 120 days, which triggers events and deletes the parameter automatically.
Parameter policies allow native lifecycle management of parameters, including expiration (deletion) and change monitoring.
2
Configure event monitoring for the parameter policies.
An Amazon EventBridge rule is set up to capture SSM Parameter Store policy execution events.
Parameter Store policy actions emit events to Amazon EventBridge, which can be captured to trigger notifications.
3
Integrate notifications using Amazon SNS.
The EventBridge rule is targeted to an Amazon SNS topic subscribed to by the operations team.
SNS provides the mechanism to deliver alerts to the operations team when the 90-day no-change threshold is crossed.

Key Concept

Systems Manager Parameter Store Parameter Policies
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic