Examkin

Soru

Zorluk: ZorSecrets Management and Parameter Store

A developer is designing a containerized microservice to be deployed on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The microservice requires secure access to two configurations:
1. A database connection string that is static and changes infrequently.
2. A payment gateway API key that must be automatically rotated every 30 days.
The microservice must retrieve the rotated API key dynamically at runtime without requiring a task restart or redeployment. The developer wants to minimize costs and API call latency.

Which combination of configuration steps should the developer implement to meet these requirements? (Select TWO.)

  1. Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store, and reference it in the ECS container definition secrets section using the ECS task execution role for decryption.Cevap
  2. Store the payment gateway API key in AWS Secrets Manager, configure automatic rotation using an AWS Lambda function, and retrieve the secret dynamically at runtime using the AWS SDK with permissions granted via the ECS task role.Cevap
  3. C
    Store the database connection string in AWS Secrets Manager, and reference it in the ECS container definition secrets section with permissions granted to the ECS task role.
  4. D
    Store the payment gateway API key in AWS Secrets Manager, configure automatic rotation using an AWS Lambda function, and inject it as an environment variable via the ECS container definition secrets section.
  5. E
    Store the payment gateway API key as a SecureString parameter in AWS Systems Manager Parameter Store, and retrieve it dynamically at runtime using the AWS SDK with credentials hardcoded in the microservice's configuration file.

Cevap

Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store, referencing it in the ECS container definition secrets section using the ECS task execution role, and store the payment gateway API key in AWS Secrets Manager, configuring automatic rotation using an AWS Lambda function, and retrieving it dynamically at runtime using the AWS SDK with permissions granted via the ECS task role.
For static values like a database connection string, Systems Manager Parameter Store is the most cost-effective solution. Using the ECS container definition's secrets section allows the ECS agent to inject the decrypted parameter as an environment variable at startup, using the Task Execution Role. For values requiring rotation, AWS Secrets Manager is the correct service due to its native support for Lambda-based rotation. To ensure the application dynamically retrieves the rotated key without a task restart, the microservice must query Secrets Manager at runtime using the AWS SDK, leveraging permissions from the ECS Task Role.

Adım Adım Çözüm

1
Analyze secret characteristics and choose the storage service.
Determine that SSM Parameter Store is the most cost-effective choice for the static string, while AWS Secrets Manager is required for the API key to utilize built-in automatic rotation.
Standard parameters in Parameter Store have no storage cost, whereas Secrets Manager charges per secret and supports Lambda-based rotation.
2
Determine the injection mechanism for the static secret.
Reference the Parameter Store SecureString in the ECS container definition secrets section.
The ECS agent will retrieve and inject the connection string as an environment variable during container startup using permissions from the task execution role. Since the connection string is static, injecting it at startup is efficient.
3
Determine the retrieval mechanism for the rotating secret.
Use the AWS SDK inside the microservice code to retrieve the API key dynamically from Secrets Manager at runtime.
Environment variables are static once the container is running; querying the API at runtime is necessary to handle rotations dynamically without restarting tasks. The task role provides the application runtime permissions.

Anahtar Kavram

Selecting and integrating Secrets Manager vs Parameter Store based on rotation requirements and ECS role configuration.
Bu soruyu puanla

Konular

Secrets Management and Parameter Store

Bu konudan daha fazla soru