Examkin

Soru

Zorluk: OrtaSecrets Management and Parameter Store

A developer is deploying a microservice to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The microservice needs to connect to an Amazon Aurora MySQL database. The database credentials must be rotated automatically every 30 days to comply with organizational security policies. The developer needs to implement a solution that retrieves these credentials securely without hardcoding them or causing application downtime during rotation.

Which two actions should the developer take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and enable automatic rotation using the built-in rotation function for Amazon RDS.Cevap
  2. Associate an IAM policy that allows the secretsmanager:GetSecretValue action to the ECS Task Role, and retrieve the credentials dynamically using the AWS SDK in the application code.Cevap
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter, and configure a custom AWS Lambda function to rotate the parameter value.
  4. D
    Attach an IAM policy that allows the secretsmanager:GetSecretValue action to the ECS Task Execution Role, and retrieve the credentials dynamically using the AWS SDK in the application code.
  5. E
    Hardcode the database connection string containing the password inside the application code, and initialize the database client directly using these credentials.

Cevap

Store the database credentials in AWS Secrets Manager with automatic RDS rotation enabled, and retrieve the credentials dynamically using the AWS SDK in the application code with permissions granted by the ECS Task Role.
To securely manage and rotate database credentials without causing downtime, the credentials should be stored in AWS Secrets Manager. Secrets Manager offers native integration with Amazon RDS to rotate secrets automatically. To access the secret from the container, the application code must query Secrets Manager using the AWS SDK, which requires assigning permissions to the ECS Task Role. Since rotation happens every 30 days, retrieving the credentials dynamically ensures that the application always uses the most current password without requiring task restarts.

Adım Adım Çözüm

1
Choose the correct secrets storage service.
AWS Secrets Manager is selected because the database credentials require automatic rotation and direct RDS integration, which are features native to Secrets Manager and not natively supported by Systems Manager Parameter Store.
This satisfies the security requirement for automatic 30-day rotation without complex custom Lambda logic.
2
Configure the application to retrieve credentials dynamically.
The application code is configured to use the AWS SDK to retrieve the database credentials from Secrets Manager at runtime rather than injecting them via environment variables at startup.
This prevents application downtime and stale credentials when rotation occurs.
3
Assign the appropriate IAM role and policy to the ECS container.
An IAM policy granting the secretsmanager:GetSecretValue permission is attached to the ECS Task Role.
The ECS Task Role is the identity assumed by the application code running inside the container to make AWS SDK calls.

Anahtar Kavram

AWS Secrets Manager vs Systems Manager Parameter Store, and ECS Task Roles vs Task Execution Roles.
Bu soruyu puanla

Konular

Secrets Management and Parameter Store

Bu konudan daha fazla soru