Q36 — AWS SAA-C03 Ch.13

Question 36 of 100 | ← Chapter 13

Q936. A company runs a Node.js function on a server in its on-premises data center.The data center stores data in a PostgreSQ database.The company stores the credentials in a connection string in an environment variable on the server.The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon RDS for PostgreSQL and to ensure that the database credentials are securely managed.Which solution will meet these requirements with the LEAST operational overhead?

• A. Store the database credentials as a parameter in AWS Systems Manager Parameter Store. Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
• B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret. ✓
• C. Store the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days
• D. Store the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retrieve the credentials from the KMS key.

Correct Answer: B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.

Explanation

The solution that meets the requirements with the LEAST operational overhead is:B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.Here's why:Secrets Management: AWS Secrets Manager is a dedicated service for managing and rotating secrets, including database credentials. It provides a secure and centralized way to store and access sensitive information.Automated Rotation: Secrets Manager offers automatic rotation of secrets, eliminating the need for manual intervention and reducing the risk of compromised credentials.Integration with Lambda: Lambda functions can easily retrieve secrets from Secrets Manager using the AWS SDK, simplifying the process of accessing credentials.Minimal Overhead: This approach requires minimal configuration and management, reducing operational overhead compared to other options.Why other options are less efficient or require more effort:A. Store the database credentials as a parameter in AWS Systems Manager Parameter Store. Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter. While Parameter Store can store sensitive information, it's primarily designed for managing configuration parameters, not secrets. It doesn't offer the same level of security and automated rotation features as Secrets Manager.C. Store the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days. This approach involves writing and managing a custom Lambda function for rotation, adding complexity and potential for errors. It also doesn't leverage a dedicated secrets management service.D. Store the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retrieve the credentials from the KMS key. KMS is primarily for managing encryption keys, not secrets. While it can be used to encrypt secrets, it doesn't provide the same level of dedicated secrets management features as Secrets Manager.In summary:Option B provides the most efficient and secure solution for managing database credentials in AWS. It leverages Secrets Manager's dedicated features for storage, rotation, and access control, minimizing operational overhead and ensuring security.