Examkin

Soru

Zorluk: OrtaSecrets Management and Parameter Store

A developer is configuring an AWS CodeBuild project that runs integration tests. These tests require credentials to access an Amazon RDS PostgreSQL database. The database credentials must be rotated automatically every 3030 days. How should the developer store and retrieve these credentials to meet the requirements with the least operational overhead?

  1. A
    Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter, and configure a custom AWS Lambda function triggered by an Amazon EventBridge scheduled rule to handle rotation.
  2. Store the credentials in AWS Secrets Manager, configure automatic rotation using the built-in AWS Lambda rotation template for Amazon RDS, and reference the secret in the CodeBuild project's buildspec file.Cevap
  3. C
    Store the credentials in AWS Systems Manager Parameter Store as a String parameter, and enable Parameter Store's native database rotation integration to update the credentials every 3030 days.
  4. D
    Store the credentials as plaintext environment variables in the AWS CodeBuild project configuration, and run a custom CLI script during the pre_build phase to update the credentials.

Cevap

Store the credentials in AWS Secrets Manager, configure automatic rotation using the built-in AWS Lambda rotation template for Amazon RDS, and reference the secret in the CodeBuild project's buildspec file.
Storing the credentials in AWS Secrets Manager is the correct approach. Secrets Manager provides native integration with Amazon RDS, allowing automatic credential rotation using built-in Lambda templates without writing custom code. CodeBuild can securely fetch these credentials dynamically during the build run by referencing them in the buildspec file.

Adım Adım Çözüm

1
Evaluate the requirement for automatic rotation of database credentials every 3030 days.
Identify that AWS Secrets Manager provides native, out-of-the-box support for rotating Amazon RDS credentials using built-in AWS Lambda templates.
Using native features minimizes custom code and operational overhead compared to manual or custom-coded solutions.
2
Compare Secrets Manager and Systems Manager Parameter Store for credential rotation.
Acknowledge that Parameter Store (even with SecureString parameters) lacks built-in automatic rotation templates for RDS, requiring custom Lambda functions and EventBridge rules.
This step eliminates options proposing Parameter Store due to the higher operational overhead requirement.
3
Integrate the secret retrieval into the AWS CodeBuild pipeline.
Reference the secret using Secrets Manager syntax in the buildspec file of the CodeBuild project.
This ensures the build environment retrieves the latest rotated credentials securely at runtime without exposing them in configuration logs or plaintext variables.

Anahtar Kavram

AWS Secrets Manager built-in rotation vs Systems Manager Parameter Store capabilities
Bu soruyu puanla

Konular

Secrets Management and Parameter Store

Bu konudan daha fazla soru