Examkin

Soru

Zorluk: OrtaSecrets Management and Parameter Store

A developer is deploying a web application to Amazon EC2 instances. The application requires access to a sensitive API key for a third-party marketing platform. The company's security policy mandates that the API key must be encrypted at rest and rotated every 90 days. The developer wants to implement a solution that supports automatic rotation with minimal custom code. Which service and configuration should the developer choose to store and manage the API key?

  1. A
    Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter. Enable the built-in Parameter Store automatic rotation feature and set the rotation interval to 90 days.
  2. Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.Cevap
  3. C
    Store the API key in AWS Systems Manager Parameter Store as a String parameter. Use a customer managed key in AWS KMS to encrypt the parameter, and write a cron job on the EC2 instances to update the parameter every 90 days.
  4. D
    Store the API key as an environment variable in the EC2 instance launch template. Use an AWS SDK client within the application code to retrieve the value from the instance metadata service.

Cevap

Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.
Storing the API key in AWS Secrets Manager and using a custom AWS Lambda function for rotation is the correct approach. Secrets Manager natively supports automatic rotation of secrets using Lambda functions. Since this is a third-party API key, a custom Lambda function is required to perform the rotation steps, meeting the 90-day rotation requirement with minimal custom code.

Adım Adım Çözüm

1
Evaluate the security and rotation requirements for the sensitive API key.
Identify that the API key must be encrypted at rest and automatically rotated every 90 days.
Establishing these requirements guides the selection of the correct AWS service that supports automatic secret rotation.
2
Compare AWS Secrets Manager and Systems Manager Parameter Store capabilities.
AWS Secrets Manager is selected because it provides built-in rotation functionality via integration with AWS Lambda, whereas Parameter Store does not support native automatic rotation.
Secrets Manager is designed specifically for managing secrets that require automatic rotation, while Parameter Store is suited for configuration management.
3
Configure the rotation mechanism for the non-AWS resource (third-party API).
A custom AWS Lambda function is configured to handle the specific rotation logic for the third-party marketing platform, and the rotation schedule is set to 90 days on the Secrets Manager secret.
For non-RDS and third-party services, Secrets Manager uses a Lambda function to perform the steps required to rotate the credentials.

Anahtar Kavram

AWS Secrets Manager vs. AWS Systems Manager Parameter Store for secrets rotation
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Secrets Management and Parameter Store

Bu konudan daha fazla soru