Examkin

Question

Difficulty: HardSecrets and Parameters Management

An application connects to an Amazon RDS for PostgreSQL database using credentials stored in AWS Secrets Manager. After enabling automatic rotation for the database credentials, the SysOps administrator notices that the application experiences brief database connection failures and API timeouts during the rotation process. The security team requires that credential rotation must not disrupt active application connections or cause downtime. Which of the following configurations is the most appropriate to resolve this issue?

  1. A
    Configure the application to query Secrets Manager for the database credentials on every database connection request to ensure it always retrieves the latest password version.
  2. B
    Set up Secrets Manager cross-region replication for the database credentials, and configure the application to failover to the replica secret during the rotation window.
  3. Configure the secret to use the alternating users rotation strategy, storing the database manager credentials in a separate secret, and allowing the rotation function to update the password of the alternating application users.Answer
  4. D
    Increase the rotation frequency to run hourly during low-traffic periods, and configure the database rotation Lambda function to run with a larger timeout value.

Answer

Configure the secret to use the alternating users rotation strategy, storing the database manager credentials in a separate secret, and allowing the rotation function to update the password of the alternating application users.
The alternating users rotation strategy uses two alternating database users. During rotation, Secrets Manager updates the password for the inactive user, updates the secret to point to that user, and allows the application to transition to the new credentials. The database continues to accept active connections from the other user with its old password, ensuring zero downtime. This requires storing the manager credentials in a separate secret so the rotation Lambda function can modify the alternating users' credentials.

Step-by-Step Solution

1
Identify the root cause of connection downtime during credential rotation.
The database credential uses a single-user rotation strategy, which changes the password for the active database user immediately. This invalidates existing sessions and causes connection errors until the application retrieves the new secret.
Understanding the limitation of the single-user rotation strategy helps isolate the requirement for a multi-user strategy.
2
Select the appropriate AWS Secrets Manager rotation strategy for zero-downtime requirements.
The alternating users rotation strategy utilizes two database users (e.g., user_A and user_B). It updates and rotates the password of the inactive user first, updates the secret pointer, and allows the active user's existing connections to persist until they naturally close.
This strategy is designed specifically for applications that cannot tolerate any downtime during rotation.
3
Configure the necessary resources for alternating users rotation.
Store the database manager credentials (which have permissions to alter user passwords) in a separate secret, link it to the application secret, and enable the alternating users rotation template.
The rotation Lambda function requires the manager user credentials to update the password of the alternating application users in the database.

Key Concept

AWS Secrets Manager Alternating Users Rotation Strategy
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic