Examkin

Soru

Zorluk: OrtaAWS CloudFormation

A developer is writing an AWS CloudFormation template to deploy an application on Amazon EC2. The application requires two configurations: a database connection password that is sensitive and must be rotated automatically every 30 days, and an environment-specific application logging level (e.g., DEBUG or INFO) that is non-sensitive and updated frequently. Which configuration strategy should the developer implement in the template to meet these requirements securely and cost-effectively?

  1. Store the database password in AWS Secrets Manager and reference it using a dynamic reference. Store the logging level in Systems Manager Parameter Store and reference it using a Parameter Store dynamic reference.Cevap
  2. B
    Store both the database password and the application logging level in AWS Secrets Manager, and reference both using Secrets Manager dynamic references.
  3. C
    Store both the database password and the application logging level in Systems Manager Parameter Store, and reference both using Parameter Store parameters with the SecureString type.
  4. D
    Deploy the EC2 instance using dummy values in the template, and then manually configure the password and logging level directly on the deployed resources after stack creation.

Cevap

Store the database password in AWS Secrets Manager and reference it using a dynamic reference. Store the logging level in Systems Manager Parameter Store and reference it using a Parameter Store dynamic reference.
The correct strategy is to store the sensitive database password requiring automatic rotation in AWS Secrets Manager and reference it via dynamic references, while using Systems Manager Parameter Store for the non-sensitive logging level configuration. This aligns with AWS security best practices and cost optimization recommendations.

Adım Adım Çözüm

1
Identify the security and rotation requirements for the database password.
The database password is sensitive and requires automatic rotation every 30 days, which is a native feature of AWS Secrets Manager.
Secrets Manager provides secure storage, built-in rotation integration for databases, and dynamic reference integration with CloudFormation.
2
Identify the requirements for the application logging level setting.
The logging level is non-sensitive, changes frequently, and does not require rotation.
Systems Manager Parameter Store is designed for configuration data and is more cost-effective than Secrets Manager for non-sensitive data.
3
Select the correct CloudFormation referencing mechanisms for both resources.
Reference the database password using a Secrets Manager dynamic reference and the logging level using a Parameter Store dynamic reference.
This combined approach maximizes security for secrets while optimizing costs for non-sensitive parameters.

Anahtar Kavram

CloudFormation dynamic references for AWS Secrets Manager and Systems Manager Parameter Store
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru