Q15 — AWS SAA-C03 Ch.14

Question 15 of 100 | ← Chapter 14

Q1015. A company runs a Node js function on a server in its on-premises data center. The data center stores data in a PostgreSQL database. The company stores the credentials in a connection string in an environment variable on the server. The company wants to migrate its application to AWS and to replace the Node.js application server with AWS Lambda. The company also wants to migrate to Amazon RDS for PostgreSQL and to ensure that the database credentials are securely managed.Which solution will meet these requirements with the LEAST operational overhead?

• A. Store the database credentials as a parameter in AWS Systems Manager Parameter Store Configure Parameter Store to automatically rotate the secrets every 30 days. Update the Lambda function to retrieve the credentials from the parameter.
• B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret. ✓
• C. Store the database credentials as an encrypted Lambda environment variable. Write a custom Lambda function to rotate the credentials. Schedule the Lambda function to run every 30 days.
• D. Store the database credentials as a key in AWS Key Management Service (AWS KMS). Configure automatic rotation for the key. Update the Lambda function to retneve the credentials from the KMS key.

Correct Answer: B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.

Explanation

To securely manage the database credentials while migrating the application to AWS Lambda and Amazon RDS for PostgreSQL, the solution that meets the requirements with the least operational overhead is:B. Store the database credentials as a secret in AWS Secrets Manager. Configure Secrets Manager to automatically rotate the credentials every 30 days. Update the Lambda function to retrieve the credentials from the secret.Explanation:\1. Using AWS Secrets Manager: Secure Storage: Secrets Manager is specifically designed for managing sensitive information like database credentials, providing built-in encryption and access control. Automatic Rotation: It supports automatic rotation of secrets, which simplifies credential management and reduces the risk of credential compromise. Integration with Lambda: Updating the Lambda function to retrieve the credentials from Secrets Manager is straightforward and requires minimal changes, leveraging the AWS SDK.\2. Operational Efficiency: - This solution minimizes the operational overhead by utilizing a managed service that handles both storage and rotation of secrets, allowing the development team to focus on application logic rather than infrastructure management.Evaluation of Other Options:A. Store the database credentials as a parameter in AWS Systems Manager Parameter Store: - While this option provides a way to store credentials securely, it does not have built-in automatic rotation capabilities like Secrets Manager. Therefore, it requires additional management overhead.C. Store the database credentials as an encrypted Lambda environment variable: - Although environment variables can store sensitive information, managing rotation would require writing and scheduling a custom Lambda function, which adds complexity and operational overhead.D. Store the database credentials as a key in AWS Key Management Service (AWS KMS): - KMS is primarily for encryption key management, not for storing credentials directly. While you could encrypt the credentials, you would still need an additional mechanism to handle rotation and management, leading to higher complexity.Conclusion:Option B is the most efficient and effective solution for securely managing database credentials with minimal operational overhead during the migration to AWS Lambda and Amazon RDS for PostgreSQL.