Examkin

Soru

Zorluk: KolayIdentity and Access Management (IAM)

A solutions architect is reviewing the security of a web application running on Amazon EC2 instances. The solutions architect finds that a database password is currently stored as a plaintext string parameter in Systems Manager Parameter Store. The company requires the database credentials to be encrypted at rest and rotated automatically every 30 days. Which solution should the solutions architect implement to meet these requirements?

  1. Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.Cevap
  2. B
    Store the credentials as a standard String parameter in Systems Manager Parameter Store and restrict access using an IAM policy.
  3. C
    Store the credentials as a SecureString parameter in Systems Manager Parameter Store, and configure the application to use the AWS account root user credentials to retrieve them.
  4. D
    Store the credentials as a SecureString parameter in Systems Manager Parameter Store, and enable AWS KMS automatic key rotation to rotate the database password.

Cevap

Store the credentials in AWS Secrets Manager, enable automatic rotation, and configure the application to retrieve the credentials from Secrets Manager.
AWS Secrets Manager natively supports both encryption at rest and automatic credential rotation (such as for Amazon RDS databases) without requiring custom code or infrastructure. The application can securely query Secrets Manager at runtime to retrieve the current password.

Adım Adım Çözüm

1
Identify the secure storage service that natively supports automatic credential rotation.
AWS Secrets Manager is chosen because it integrates directly with database services to handle password rotation automatically.
This avoids custom scripting overhead and satisfies the security requirements.
2
Configure the application to dynamically fetch the credentials at runtime using the AWS SDK.
The application is updated to call the Secrets Manager API instead of hardcoding or querying plaintext parameters.
Ensures the application always uses the active, rotated credentials securely.

Anahtar Kavram

Secure secrets storage and lifecycle management using AWS Secrets Manager
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru