Examkin

Soru

Zorluk: ZorSecrets Management and Parameter Store

A developer is deploying a containerized API to AWS App Runner. The application needs to retrieve credentials for a backend Amazon Aurora MySQL database, which must be rotated automatically every 45 days. Additionally, the application requires access to 50 non-sensitive configuration parameters, such as service endpoints and logging levels, which are updated frequently. The developer wants to implement a secure, cost-effective architecture.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function template.Cevap
  2. Store the non-sensitive logging levels and service endpoints as standard parameters in AWS Systems Manager Parameter Store.Cevap
  3. C
    Store both the database credentials and the non-sensitive configuration parameters in AWS Secrets Manager to simplify client-side SDK integration.
  4. D
    Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter, and write a custom EventBridge rule to trigger rotation.
  5. E
    Configure the App Runner service environment variables to host the database credentials directly to minimize API call latency.

Cevap

The correct combination is to store the database credentials in AWS Secrets Manager with built-in Lambda automatic rotation, and store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as standard parameters.
The correct solution uses AWS Secrets Manager for the database credentials because Secrets Manager natively supports automatic rotation using built-in Lambda templates. It uses AWS Systems Manager Parameter Store (standard parameters) for the non-sensitive parameters because standard parameters are free, ensuring the overall architecture is cost-effective.

Adım Adım Çözüm

1
Analyze credential security and rotation requirements.
Identify that the Aurora database credentials require security and automated rotation every 45 days. AWS Secrets Manager is the optimal service here because it offers out-of-the-box rotation support using Lambda templates specifically integrated with RDS/Aurora.
Ensures credentials are secure and rotated without custom scripting overhead.
2
Analyze non-sensitive configuration requirements and cost constraints.
Identify that logging levels and service endpoints are non-sensitive and numerous (50 parameters). Storing them in AWS Systems Manager Parameter Store as standard parameters is free, satisfying the cost-efficiency constraint.
Minimizes unnecessary Secrets Manager charges for non-sensitive data.

Anahtar Kavram

Secrets Manager vs Systems Manager Parameter Store
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Secrets Management and Parameter Store

Bu konudan daha fazla soru