A developer is configuring a microservices application running on Amazon Elastic Kubernetes Service (Amazon EKS). The application needs to retrieve database credentials to connect to an Amazon RDS for Microsoft SQL Server database. The company's security policy requires that these credentials be encrypted at rest and automatically rotated every 30 days without manual intervention or application redeployment. Which TWO steps should the developer perform to meet these requirements securely? (Select TWO.)
- Store the database credentials in AWS Secrets Manager.Cevap
- Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.Cevap
- CStore the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter.
- DConfigure an Amazon EventBridge scheduled rule to trigger a custom script that rotates the database password and updates the parameter in Systems Manager Parameter Store.
- EHardcode the database credentials within the application's codebase and decrypt them at runtime using the AWS SDK and a customer managed key in AWS KMS.
Cevap
Store the database credentials in AWS Secrets Manager and configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.
Storing the database credentials in AWS Secrets Manager is correct because Secrets Manager is designed for storing sensitive data like database credentials and supports automatic rotation natively. Configuring Secrets Manager to use an AWS Lambda rotation function to update the database credentials every 30 days fulfills the rotation requirement with minimal operational overhead, since AWS provides pre-built Lambda templates for RDS database credential rotation.
Adım Adım Çözüm
Anahtar Kavram
AWS Secrets Manager vs Systems Manager Parameter Store for credentials requiring rotation
Tahmini Süre:1m 30s