A developer is deploying a microservice on Amazon ECS using AWS Fargate that connects to an Amazon Aurora PostgreSQL database. The application must retrieve a database endpoint (non-sensitive configuration) and a database password (sensitive credential). The database password must be automatically rotated every 30 days. The microservice handles a very high volume of requests, so the developer must design a solution that prevents database connection failures after rotation, avoids API throttling errors, and minimizes costs. Which approach should the developer take to retrieve and manage these configurations?
- Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.Cevap
- BStore both the database endpoint and the password as standard parameters in Systems Manager Parameter Store. Enable parameter policies to automatically rotate the password parameter every 30 days, and retrieve both values inside the microservice code on every request using the AWS SDK.
- CStore both the database endpoint and the database password in AWS Secrets Manager. Initialize the Secrets Manager SDK client in the microservice code by passing hardcoded IAM access keys and secret keys of a dedicated IAM user to bypass IAM role credential retrieval latency.
- DStore the database endpoint in Systems Manager Parameter Store and the database password in AWS Secrets Manager. Reference both the parameter and the secret in the ECS task definition as environment variables, allowing the containerized application to read them directly from the local environment.
Cevap
Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.
The correct strategy combines Systems Manager Parameter Store for non-sensitive configurations and AWS Secrets Manager for sensitive credentials that need automatic rotation. Under high-throughput environments, fetching credentials on every request will cause API throttling. Caching values locally with a Time-to-Live (TTL) ensures low latency and avoids API rate limiting, while the TTL expiration guarantees that the microservice eventually fetches the new password after an automatic rotation, avoiding database connection issues.
Adım Adım Çözüm
Anahtar Kavram
Selecting and integrating AWS Secrets Manager and Systems Manager Parameter Store with caching to support credentials rotation in high-throughput applications.