Examkin

Soru

Zorluk: KolayAWS CloudFormation

A developer is configuring an AWS CloudFormation template to deploy an Amazon RDS DB instance. The database requires a master password that must be stored securely and rotated automatically every 30 days to comply with company security policies. Which configuration should the developer use to reference and manage the password?

  1. A
    Store the database password in Systems Manager Parameter Store as a SecureString parameter, and reference it using the ssm-secure dynamic reference in the template.
  2. Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.Cevap
  3. C
    Store the database password in Systems Manager Parameter Store as a String parameter, and reference it using the ssm dynamic reference in the template.
  4. D
    Hardcode the password in the CloudFormation template, and then manually change it in the Amazon RDS console after deployment to trigger a stack drift detection and alignment.

Cevap

Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.
The correct option stores the database password in AWS Secrets Manager, which natively supports automatic rotation, and references it using the secretsmanager dynamic reference in the template. This ensures that the secret is kept secure and is retrieved dynamically during deployment.

Adım Adım Çözüm

1
Analyze the requirements: secure storage of a database password and support for automatic rotation.
Identify that AWS Secrets Manager is the appropriate service for credentials requiring automatic rotation, whereas Systems Manager Parameter Store does not support native rotation.
Choosing the correct AWS service ensures security compliance and automation features are utilized.
2
Determine how to reference the secret in the CloudFormation template.
Identify that the secretsmanager dynamic reference should be used.
Dynamic references retrieve sensitive information at deployment time without storing it in plaintext or parameters.

Anahtar Kavram

AWS CloudFormation Dynamic References and Secrets Management
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru