Examkin

Soru

Zorluk: ZorSecrets and Parameter Management

An enterprise is deploying a microservices application on Amazon ECS using the AWS Fargate launch type. The application requires access to two sensitive values: a database password for an Amazon Aurora PostgreSQL DB cluster, and a static API key for a third-party payment provider. The security requirements mandate that: 1. The database password must be rotated automatically every 30 days. 2. The third-party API key must be encrypted at rest and retrieved securely by the ECS tasks at startup, but it does not require rotation. 3. Access to all credentials must be monitored and audited. 4. The architecture must minimize operational complexity and cost. Which approach meets these requirements?

  1. A
    Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter and enable AWS KMS automatic key rotation on the Customer Managed Key (CMK) used to encrypt the parameter. Store the third-party API key as a String parameter in Parameter Store.
  2. B
    Store both the database password and the third-party API key as String parameters in AWS Systems Manager Parameter Store. Configure an IAM task execution role for the ECS tasks to restrict access to the parameters, and retrieve them directly from the container applications.
  3. Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS. Store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter, and reference this parameter in the container definition of the Amazon ECS task definition.Cevap
  4. D
    Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter. Write a custom AWS Lambda function triggered by an Amazon EventBridge scheduled rule to update both the Parameter Store value and the database password every 30 days. Store the third-party API key as a String parameter in Parameter Store.

Cevap

Store the database password in AWS Secrets Manager with built-in RDS rotation, and store the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter injected into the ECS tasks at startup.
The correct architecture uses AWS Secrets Manager for the Aurora PostgreSQL password because it natively integrates with RDS to handle database credential rotation automatically without code changes or operational overhead. It uses AWS Systems Manager Parameter Store with a SecureString parameter for the payment provider API key because it does not require rotation, making Parameter Store a more cost-effective solution. Referencing the Parameter Store SecureString in the ECS task definition ensures the secret is fetched at task startup and injected as an environment variable, minimizing runtime API costs and latency.

Adım Adım Çözüm

1
Select the storage and rotation mechanism for the database password.
AWS Secrets Manager is selected.
Secrets Manager provides native, out-of-the-box integration with Amazon RDS and Aurora for automated 30-day password rotation, eliminating the need to write and maintain custom Lambda functions.
2
Select the storage and retrieval mechanism for the static third-party API key.
AWS Systems Manager Parameter Store with a SecureString parameter is selected.
Parameter Store SecureString encrypts data at rest using AWS KMS. Since the API key does not require rotation, Parameter Store is a highly cost-effective choice compared to Secrets Manager.
3
Configure the retrieval pattern for the API key to optimize ECS task performance and costs.
Inject the Parameter Store parameter as an environment variable in the ECS task definition.
By referencing the parameter in the ECS task definition container properties, Fargate retrieves the value during container initialization. This prevents the application from making repeated, costly runtime API calls to Parameter Store for every transaction.

Anahtar Kavram

Selecting and integrating Secrets Manager and Systems Manager Parameter Store based on automatic rotation needs, cost, and security.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Secrets and Parameter Management

Bu konudan daha fazla soru