Examkin

Soru

Zorluk: OrtaSecrets and Parameter Management

A company is migrating a legacy HR application to Amazon EC2 instances. The application requires access to a database password that must be rotated every 60 days to comply with internal security policies. The database is hosted on Amazon RDS. The security team mandates that the password must be encrypted at rest using a customer managed key, and that the rotation process must be automated with minimal operational effort.

Which solution should a solutions architect recommend to meet these requirements?

  1. A
    Store the database password as a String parameter in AWS Systems Manager Parameter Store. Write a custom script on the EC2 instances that runs every 60 days via a cron job to retrieve the plaintext password, generate a new password, and update the database.
  2. B
    Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store and encrypt it using a customer managed KMS key. Enable automatic rotation on the customer managed KMS key with a rotation period of 60 days to automatically update the password value.
  3. Store the database password in AWS Secrets Manager and encrypt it using an AWS Key Management Service (AWS KMS) customer managed key. Configure Secrets Manager to automatically rotate the password every 60 days using a configured AWS Lambda function.Cevap
  4. D
    Store the database password in AWS Secrets Manager and encrypt it using an AWS KMS customer managed key. Enable automatic annual rotation on the customer managed KMS key, which will automatically trigger the rotation of the database password and re-encrypt historical database records under the new key version.

Cevap

Store the database password in AWS Secrets Manager, encrypt it using an AWS KMS customer managed key, and configure automatic rotation every 60 days using an AWS Lambda function.
AWS Secrets Manager is designed for storing secrets such as database credentials and supports automated rotation through AWS Lambda. It allows encryption using customer managed AWS KMS keys, which satisfies all the compliance and operational requirements with minimal overhead.

Adım Adım Çözüm

1
Select AWS Secrets Manager as the credential storage solution.
AWS Secrets Manager supports native integration with AWS Lambda to automatically rotate database credentials without requiring application downtime.
Systems Manager Parameter Store does not support out-of-the-box automated rotation of parameter values.
2
Configure AWS KMS customer managed key encryption.
Secrets Manager encrypts the secret value at rest using the specified customer managed key, satisfying the security team's encryption mandate.
This provides control over key policies and rotation of the key material independent of the secret itself.
3
Associate an AWS Lambda function for rotation and set the rotation schedule to 60 days.
The Lambda function updates the database credentials in RDS and the secret value in Secrets Manager automatically.
This removes the need to write and manage custom rotation cron scripts on the EC2 instances, achieving the least operational overhead.

Anahtar Kavram

AWS Secrets Manager supports automatic secrets rotation using AWS Lambda, whereas KMS key rotation only rotates encryption key material and not the stored secret values.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Secrets and Parameter Management

Bu konudan daha fazla soru