DVA-C02 · Question #718
A developer needs to improve security for database credentials in an Amazon ECS environment. Currently, the developer stores Amazon Aurora PostgreSQL credentials directly in ECS task definition…
The correct answer is C. Store the credentials as a secret in AWS Secrets Manager. Create a task IAM role that has. Storing credentials in AWS Secrets Manager and referencing them directly in the ECS task definition’s secrets section enables secure retrieval of secrets at runtime without embedding sensitive data in environment variables. Assigning the correct task IAM role permissions allows…
Question
A developer needs to improve security for database credentials in an Amazon ECS environment. Currently, the developer stores Amazon Aurora PostgreSQL credentials directly in ECS task definition environment variables. The developer must implement a more secure method to provide the database credentials to running task instances. Which solution will meet these requirements with the LEAST development effort?
Options
- ACreate a customer managed AWS KMS key. Use the KMS key to encrypt the credentials. Add the
- BUse an AWS managed AWS KMS key to encrypt the credentials. Add the encrypted credentials
- CStore the credentials as a secret in AWS Secrets Manager. Create a task IAM role that has
- DStore the credentials as a secret in AWS Secrets Manager. Create a task execution IAM role that
How the community answered
(24 responses)- A8% (2)
- B8% (2)
- C79% (19)
- D4% (1)
Explanation
Storing credentials in AWS Secrets Manager and referencing them directly in the ECS task definition’s secrets section enables secure retrieval of secrets at runtime without embedding sensitive data in environment variables. Assigning the correct task IAM role permissions allows seamless access with minimal development effort.
Community Discussion
No community discussion yet for this question.