A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases. Which solution meets this requirement with the LEAST operational overhead?
A.
Store the password in AWS Secrets Manager. Enable automatic rotation on the secret.
B.
Store the password in AWS Systems Manager Parameter Store. Enable automatic rotation on the parameter.
C.
Store the password in AWS Systems Manager Parameter Store. Write an AWS Lambda function that rotates the password.
D.
Store the password in AWS Key Management Service (AWS KMS). Enable automatic rotation on the customer master key (CMK).
Agreed answer is (A), only service that rotates credentials automatically is secrets manager.
https://aws.amazon.com/secrets-manager/
https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html (reference note)
A - we need to store a DB password, with automatic rotation every few months
A. Store the password in AWS Secrets Manager. Enable automatic rotation on the secret.
- Correct. https://aws.amazon.com/secrets-manager/
B. Store the password in AWS Systems Manager Parameter Store. Enable automatic rotation on the parameter.
- Wrong. Systems Manager is for monitoring and configuring resources (e.g. S3, EC2, RDS instances), not for storing sensitive credentials
C. Store the password in AWS Systems Manager Parameter Store. Write an AWS Lambda function that rotates the password.
- Wrong. Manual rotation is not ideal
D. Store the password in AWS Key Management Service (AWS KMS). Enable automatic rotation on the customer master key (CMK).
- KMS is for managing keys used for the encryption / decryption of data, NOT for storing authentication credentials
for B, I would argue it is still ok to use Systems Manager Parameter Store store credentials. But the Parameter Store itself need to use Secrets Manager to implement password roration, and that's why we do not choose B. See the first 'Note'
https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
A - correct answer view the AWS rotate password screenshot from AWS - shows the enable button
https://aws.amazon.com/blogs/aws/aws-secrets-manager-store-distribute-and-rotate-credentials-securely/
Rta es A. Secrets Manager las funciones claves son: Rotar secretos de forma segura, Proteja y gestione secretos de forma centralizada, Supervise y audite fácilmente, Pague por los secretos que almacena
=> A
Parameter store : no support rotate key
AWS KMS: generates, encrypts, and decrypts data keys. However, AWS KMS does not store, manage, or track your data keys, or perform cryptographic operations with data keys.
https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html
Answer-A Secrets Manager
This question is testing Secrets Manager vs Parameter Store.
A very short read:https://medium.com/awesome-cloud/aws-difference-between-secrets-manager-and-parameter-store-systems-manager-f02686604eae
Secrets Manager: It was designed specifically for confidential information (like database credentials, API keys) that needs to be encrypted, so the creation of a secret entry has encryption enabled by default. It also gives additional functionality like rotation of keys.
Systems Manager Parameter Store: It was designed to cater to a wider use case, not just secrets or passwords, but also application configuration variables like URLs, Custom settings, AMI IDs, License keys, etc.
Secrets Manager offers rotation of keys inbuilt. It is integrated well with RDS.
B is invalid-notinbuilt for Parameter Store
C-adds more overhead compared to inbuilt feature in A
D-KMS is altogether different concept.
KMS is a service that manages encryption keys('Customer Master keys',not Data keys).
A 'data key' is used to encrypt the actual data data.
CMK is basically used to protect the data key which is used for encrypting data.
To decrypt the data,one calls the KMS service and uses the CMK to decrypt the 'data key'.Once we have the decrypted(plaintext) data key, we use the same to decrypt the actual data.
When thinking KMS/CMK---
-think about Cx managed/Aws Managed Keys as options
-think encryption at rest
-think encrypting master key, not data key
Answer is A
AWS Secrets Manager enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets through their lifecycle
New Question:
A company is running a publicly accessible serverless application that uses Amazon API Gateway and AWS Lambda. The application's traffic recently spiked due to fraudulent requests from botnets.
Which steps should a solutions architect take to block requests from unauthorized users? (Choose two.)
a Create a usage plan with an API key that is shared with genuine users only.
b Integrate logic within the Lambda function to ignore the requests from fraudulent IP addresses.
c Implement an AWS WAF rule to target malicious requests and trigger actions to filter them out.
d Convert the existing public API to a private API. Update the DNS records to redirect users to the new API endpoint.
e Create an IAM role for each user attempting to access the API. A user will assume the role when making the API call.
Answer: C, D
A - Wrong - Key should never be shared
B - You will never know which IPs to block. IPs can be masked
E - IAM role for each user - means you need to know all the users
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Hizumi
Highly Voted 3 years, 7 months agoweilun_tann
Highly Voted 3 years, 4 months agozaxzax292
3 years, 1 month agoqueen101
Most Recent 2 years, 8 months agoslcheng
2 years, 9 months agonaveenagurjara
2 years, 10 months agojennyka76
3 years, 3 months agoaprendiendo
3 years, 4 months agoitchi_vo
3 years, 5 months agotinyshare
3 years, 5 months agogargaditya
3 years, 5 months agogargaditya
3 years, 5 months agotrihuynh
3 years, 6 months agovizzdoom
3 years, 6 months agoAlfio
3 years, 6 months agotrihuynh
3 years, 6 months agohumanwings
3 years, 6 months agoRajjay
3 years, 5 months agoGeniusMikeLiu
3 years, 6 months ago