An organization runs a containerized payment processing service on Amazon ECS that requires credentials to access an Amazon RDS for MySQL database. The organization's security policy requires the database credentials to be rotated every 30 days. Additionally, the AWS Key Management Service (AWS KMS) customer managed key used to encrypt the credentials must be rotated annually. The policy also specifies that once the KMS key is rotated, the stored credentials must be immediately re-encrypted with the new key material to ensure that the retired key material is no longer used to protect the active credentials. Which solution should a solutions architect recommend to satisfy these security requirements?
- Store the credentials in AWS Secrets Manager with automatic rotation enabled on a 30-day schedule. Enable automatic key rotation on the KMS customer managed key. Configure an AWS Lambda function triggered by AWS CloudTrail events for KMS key rotation to programmatically update the secret value, forcing Secrets Manager to re-encrypt the credentials using the new key material.Cevap
- BStore the credentials in AWS Systems Manager Parameter Store as a String parameter. Configure an Amazon EventBridge rule to trigger an AWS Lambda function every 30 days to rotate the database credentials and update the parameter. Enable automatic key rotation on the KMS customer managed key.
- CStore the credentials in AWS Secrets Manager with automatic rotation enabled on a 30-day schedule. Enable automatic key rotation on the KMS customer managed key, which automatically and immediately re-encrypts the existing database credentials in Secrets Manager with the new key material.
- DStore the credentials in AWS Systems Manager Parameter Store as a SecureString parameter. Enable automatic rotation for the parameter on a 30-day schedule. Enable automatic key rotation on the KMS customer managed key, and configure Parameter Store to automatically re-encrypt the parameter value using the new key version.
Cevap
Store the credentials in AWS Secrets Manager with 30-day automatic rotation, enable automatic key rotation on the KMS customer managed key, and use a Lambda function triggered by CloudTrail key rotation events to programmatically update and re-encrypt the secret.
The correct solution uses AWS Secrets Manager for database credentials because it provides built-in 30-day automatic rotation for RDS databases. Since automatic KMS customer managed key rotation does not retroactively re-encrypt existing ciphertexts, a custom workflow using AWS CloudTrail, EventBridge, and AWS Lambda is required to detect the key rotation event, retrieve the secret, and update it. This update action forces Secrets Manager to request a new encryption operation from KMS, which will use the newly rotated key material to encrypt the active credentials immediately.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS key rotation mechanics do not retroactively re-encrypt existing ciphertexts; dynamic re-encryption requires a re-save or manual re-encryption operation.
Tahmini Süre:2m 30s