AWS Certified Sysops Administrator Associate · Free Practice Question Medium
Question 41
A manufacturing firm employs an Amazon RDS DB instance for tracking its inventory. Various AWS Lambda functions are maintained by the firm for interacting with the database to add, remove, and modify items. The Lambda functions connect to the database using credentials stored in the function code
A SysOps administrator must ensure that the database credentials are not saved in plaintext and that the passwords are changed every 30 days.
What solution can best accomplish these requirements in the most operationally effective way?
-
A
Save the database password as an environment variable for each Lambda function. Create a new Lambda function for rotating the password. Use Amazon EventBridge to schedule the password rotation function every 30 days to modify the database password and refresh the environment variables for each Lambda function.
-
B
Use AWS Secrets Manager to store the database credentials. Create a Secrets Manager secret and choose the appropriate database so that the Secrets Manager will use a Lambda function to automatically update the database password. Establish an automatic rotation schedule of 30 days. Modify each Lambda function to access the database password from Secrets Manager.
-
C
Implement AWS KMS to encrypt the database password and store the encrypted password as an environment variable for each Lambda function. Provide each Lambda function access to the KMS key, enabling the database password to be decrypted when necessary. Create a new Lambda function that rotates the password every 30 days.
-
D
Employ AWS Systems Manager Parameter Store to create a secure string to save the database credentials. Develop a new Lambda function for rotating the password. Utilize Amazon EventBridge to schedule the password rotation function every 30 days to change the database password and update the secret within Parameter Store. Modify each Lambda function to access the database password from Parameter Store.
Reveal correct answer
Correct answer: B
Explanation
With Secrets Manager, you can secure and manage secrets used to access resources in the AWS Cloud, on third-party services, and on-premises. Particularly relevant to the given scenario, Secrets Manager offers built-in support for rotating credentials for Amazon RDS, Amazon DocumentDB, and Amazon Redshift. It natively integrates with these services to rotate secrets securely without requiring any code changes in your applications.
When setting up Secrets Manager to automatically rotate secrets (i.e., the password in this scenario), you specify the rotation interval (30 days in this case). Secrets Manager will automatically trigger a Lambda function to rotate the password when the interval expires.
The Lambda functions interacting with the database would retrieve the latest version of the password from Secrets Manager each time they need to access the database, ensuring they always use the most current password.
CORRECT: "Use AWS Secrets Manager to store the database credentials. Create a Secrets Manager secret and choose the appropriate database so that the Secrets Manager will use a Lambda function to automatically update the database password. Establish an automatic rotation schedule of 30 days. Modify each Lambda function to access the database password from Secrets Manager" is the correct answer (as explained above.)
INCORRECT: "Save the database password as an environment variable for each Lambda function. Create a new Lambda function for rotating the password. Use Amazon EventBridge to schedule the password rotation function every 30 days to modify the database password and refresh the environment variables for each Lambda function" is incorrect.
Although this option would technically work, it is not the most operationally efficient or secure. The method of storing database passwords as environment variables in plaintext is not secure. Password rotation is also handled manually, which is less efficient and potentially more error-prone than the automated rotation provided by AWS Secrets Manager.
INCORRECT: "Implement AWS KMS to encrypt the database password and store the encrypted password as an environment variable for each Lambda function. Provide each Lambda function access to the KMS key, enabling the database password to be decrypted when necessary. Create a new Lambda function that rotates the password every 30 days" is incorrect.
AWS KMS is primarily for key management and is not designed to handle automatic credential rotation. While you could manually rotate the passwords and re-encrypt them with KMS, this is far less operationally efficient than using AWS Secrets Manager, which is designed to handle this kind of task and automatically rotates credentials.
INCORRECT: "Employ AWS Systems Manager Parameter Store to create a secure string to save the database credentials. Develop a new Lambda function for rotating the password. Utilize Amazon EventBridge to schedule the password rotation function every 30 days to change the database password and update the secret within Parameter Store. Modify each Lambda function to access the database password from Parameter Store" is incorrect.
While Systems Manager Parameter Store provides secure, hierarchical storage for configuration data management and secrets management, it does not support automatic password rotation like AWS Secrets Manager does. The process of password rotation is manual in this case, and less operationally efficient.
References:
https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
