Examkin

Soru

Zorluk: OrtaSecrets and Parameter Management

A solutions architect is designing a configuration management strategy for a containerized application. The application requires access to two types of data: database credentials for an Amazon Aurora MySQL database, which must be rotated automatically every 30 days, and external API endpoints that must be encrypted at rest but do not change. To minimize monthly costs and administrative effort, which combination of actions should the solutions architect take? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda function template.Cevap
  2. Store the external API endpoints as SecureString parameters in AWS Systems Manager Parameter Store.Cevap
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as String parameters to reduce AWS KMS decryption latency.
  4. D
    Store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store and enable AWS KMS automatic key rotation to automatically rotate the database password.
  5. E
    Store the external API endpoints as String parameters in AWS Systems Manager Parameter Store to avoid the complexity of managing KMS keys.

Cevap

Store the database credentials in AWS Secrets Manager with automatic rotation using the built-in Lambda template, and store the external API endpoints as SecureString parameters in AWS Systems Manager Parameter Store.
The correct solution involves storing the database credentials in AWS Secrets Manager with automatic rotation enabled using the built-in Lambda function template, and storing the static API endpoints as SecureString parameters in AWS Systems Manager Parameter Store. Secrets Manager provides native, out-of-the-box automatic rotation for RDS and Aurora databases, which eliminates the need to build and maintain custom rotation code. For the static API endpoints, Parameter Store SecureString parameters provide encryption at rest via AWS KMS at no additional cost for standard parameters, representing the most cost-efficient option since Secrets Manager incurs a monthly cost per secret.

Adım Adım Çözüm

1
Evaluate the database credential requirements.
The credentials require automatic rotation every 30 days. AWS Secrets Manager is the optimal service here because it offers native integration with RDS and Aurora to handle rotation automatically using built-in Lambda templates.
This minimizes administrative effort compared to writing custom rotation logic in Systems Manager Parameter Store.
2
Evaluate the static API endpoint configuration requirements.
The endpoints must be encrypted at rest but do not change frequently or require rotation. AWS Systems Manager Parameter Store using the SecureString parameter type is the most cost-effective choice.
Parameter Store standard parameters are free, whereas AWS Secrets Manager charges a monthly flat rate per secret.
3
Combine the evaluations to select the correct options.
Using AWS Secrets Manager for the rotating database credentials and Parameter Store SecureString parameters for the static API endpoints satisfies all security, rotation, cost, and administrative constraints.
This hybrid approach leverages the strengths of both services to optimize costs and minimize overhead.

Anahtar Kavram

Secrets and Parameter Management
Bu soruyu puanla

Konular

Secrets and Parameter Management

Bu konudan daha fazla soru