Examkin

Soru

Zorluk: ZorSecrets Management and Parameter Store

A developer is configuring a web application running on Amazon EC2 instances in an Auto Scaling group. The application must retrieve a database password to connect to an Amazon Aurora PostgreSQL DB cluster. The database password must be rotated every 30 days. Both the EC2 instances and the database cluster are deployed in private subnets within a VPC that has no internet connectivity. Which combination of steps should the developer take to meet these requirements securely with the minimum operational overhead?

  1. Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.Cevap
  2. B
    Store the database password in Systems Manager Parameter Store as a SecureString parameter. Write a custom AWS Lambda function to rotate the password in the database and update the parameter. Configure an Amazon EventBridge rule to trigger the Lambda function every 30 days, and configure the EC2 instances to retrieve the parameter by hardcoding database read-only IAM access keys in the application source code.
  3. C
    Store the database password in Systems Manager Parameter Store as a SecureString parameter. Configure the application to retrieve the password by reading a plaintext configuration file stored in a public Amazon S3 bucket. Configure a scheduled Amazon EventBridge rule to update the S3 file every 30 days.
  4. D
    Store the database password in Systems Manager Parameter Store as a SecureString parameter. Write a custom AWS Lambda function to rotate the password in the database and update the parameter. Configure the Lambda function to run inside the VPC and access Systems Manager using a NAT Gateway, and associate an IAM instance profile with the EC2 instances to retrieve the parameter.

Cevap

Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.
The correct solution uses AWS Secrets Manager, which natively supports automated rotation of RDS database credentials using pre-built Lambda templates. Since the database and EC2 instances reside in a private VPC without internet access, deploying the Lambda rotation function inside the VPC allows it to reach the database. Creating an interface VPC endpoint for Secrets Manager allows the EC2 instances and the Lambda rotation function to securely interact with Secrets Manager privately. Access is granted to the EC2 instances via an IAM instance profile, ensuring no credentials are hardcoded.

Adım Adım Çözüm

1
Store the secret in AWS Secrets Manager.
The database password is encrypted and stored securely.
AWS Secrets Manager is designed for storing secrets (like passwords and API keys) and supports native automatic rotation.
2
Enable automatic rotation using the standard RDS template and deploy the rotation Lambda function within the VPC private subnets.
Secrets Manager automatically manages password updates in both the database and the secret storage every 30 days.
Since the database has no public internet access, the Lambda function must run inside the VPC to connect to the database cluster and update the password.
3
Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.
The EC2 instances and the Lambda rotation function can securely connect to Secrets Manager without internet access.
An interface VPC endpoint allows secure, private traffic routing to AWS services within a isolated VPC.
4
Attach an IAM role containing Secrets Manager read access to the EC2 instance profile.
The application retrieves the credential dynamically at runtime.
This avoids hardcoding credentials and uses temporary security credentials instead.

Anahtar Kavram

AWS Secrets Manager vs. Systems Manager Parameter Store and Private VPC Networking Integration
Bu soruyu puanla

Konular

Secrets Management and Parameter Store

Bu konudan daha fazla soru