Examkin

Soru

Zorluk: KolaySecrets Management and Parameter Store

A developer is configuring a containerized application running in AWS Batch. The application requires access to two sensitive values: a database password for an Amazon Aurora PostgreSQL database that must be rotated every 30 days, and an API key for a partner service that is static and does not require rotation. The developer wants to minimize costs while maintaining high security.

Which actions should the developer take to configure the storage for these secrets? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and enable automatic rotation using the built-in AWS Lambda rotation template for Amazon Aurora.Cevap
  2. Store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.Cevap
  3. C
    Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter and enable native automatic rotation.
  4. D
    Store the partner API key in AWS Secrets Manager and configure a scheduled AWS Lambda function to rotate it every 30 days.
  5. E
    Hardcode the database password and the partner API key directly inside the environment variables of the AWS Batch job definition.

Cevap

Store the database password in AWS Secrets Manager with automatic rotation enabled, and store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database password requires automatic rotation, which is a native feature of AWS Secrets Manager. The partner API key is static and does not require rotation, making Systems Manager Parameter Store (SecureString) the most cost-effective and secure choice.

Adım Adım Çözüm

1
Identify the rotation requirement for the database password.
Since the Aurora PostgreSQL database password requires automatic rotation every 30 days, AWS Secrets Manager should be selected because it natively supports automatic rotation via built-in AWS Lambda templates for RDS.
AWS Systems Manager Parameter Store does not support native automatic rotation.
2
Identify the rotation and cost requirements for the partner API key.
Since the partner API key is static, does not require rotation, and the goal is to minimize costs, AWS Systems Manager Parameter Store (specifically a SecureString parameter) should be selected.
AWS Secrets Manager charges a monthly fee per secret, making it less cost-effective than Parameter Store for static configurations, while SecureString parameters provide the same level of encryption.

Anahtar Kavram

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation needs and cost efficiency.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Secrets Management and Parameter Store

Bu konudan daha fazla soru