SAP-C02 · Question #674
A company is deploying AWS Lambda functions that access an Amazon RDS for PostgreSQL database. The company needs to launch the Lambda functions in a QA environment and in a production environment…
The correct answer is B. Store the database credentials for both environments in AWS Secrets Manager with distinct key. Store and manage database credentials for Lambda functions in QA and production environments securely, without exposing them in code, and with automatic rotation.
Question
A company is deploying AWS Lambda functions that access an Amazon RDS for PostgreSQL database. The company needs to launch the Lambda functions in a QA environment and in a production environment. The company must not expose credentials within application code and must rotate passwords automatically. Which solution will meet these requirements?
Options
- AStore the database credentials for both environments in AWS Systems Manager Parameter
- BStore the database credentials for both environments in AWS Secrets Manager with distinct key
- CStore the database credentials for both environments in AWS Key Management Service (AWS
- DCreate separate S3 buckets for the QA environment and the production environment. Turn on
How the community answered
(56 responses)- A5% (3)
- B84% (47)
- C2% (1)
- D9% (5)
Why each option
Store and manage database credentials for Lambda functions in QA and production environments securely, without exposing them in code, and with automatic rotation.
AWS Systems Manager Parameter Store can store secrets, but it does not natively provide automatic rotation capabilities for database credentials, which is a key requirement.
AWS Secrets Manager is specifically designed to store, retrieve, and automatically rotate database credentials, preventing them from being hardcoded in application code and enhancing security; using distinct secrets for each environment ensures isolation.
AWS Key Management Service (AWS KMS) is for managing encryption keys, not for storing and rotating database credentials directly; it would be used by Secrets Manager to encrypt the secrets.
Storing credentials in S3 buckets, even with encryption, is not the recommended or secure way to manage database credentials for application access, nor does it provide automatic rotation.
Concept tested: Secure credential management and rotation with AWS Secrets Manager
Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html
Community Discussion
No community discussion yet for this question.