Q16 — AWS SAA-C03 Ch.14

Question 16 of 100 | ← Chapter 14

Q1016. A company has a custom application with embedded credentials that retrieves information from a database in an Amazon RDS for MySQL DB cluster. The company needs to make the application more secure with minimal programming effort. The company has created credentials on the RDS for MySQL database for the application user.Which solution will meet these requirements?

• A. Store the credentials in AWS Key Management Service (AWS KMS). Create keys in AWS KMS.Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation
• B. Store the credentials in encrypted local storage. Configure the application to load the database credentials from the local storage. Set up a credentials rotation schedule by creating a cron job.
• C. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager. ✓
• D. Store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule in the RDS for MySQL database by using Parameter Store.

Correct Answer: C. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager.

Explanation

To make the application more secure with minimal programming effort while managing the embedded credentials for accessing an Amazon RDS for MySQL DB cluster, the best solution is:C. Store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule by creating an AWS Lambda function for Secrets Manager.Explanation:\1. AWS Secrets Manager: Secure Storage: Secrets Manager is designed specifically for managing sensitive information like database credentials. It provides built-in encryption and fine-grained access control. Automatic Rotation: Secrets Manager supports automatic rotation of credentials, which enhances security by ensuring that the application does not use stale or compromised credentials.\2. Minimal Programming Effort: - Integrating Secrets Manager into the application typically requires minimal changes, as you can leverage the AWS SDK to retrieve credentials easily. This approach allows you to enhance security without significant development overhead.\3. Enhanced Security: - By using Secrets Manager, you eliminate the need to hard-code credentials in the application, which is a common security risk. It also allows for centralized management of secrets.Evaluation of Other Options:A. Store the credentials in AWS KMS: - KMS is primarily for managing encryption keys, not for storing credentials directly. While you could encrypt credentials with KMS, this option does not address the need for easy retrieval or automatic rotation effectively.B. Store the credentials in encrypted local storage: - This approach would require significant programming to implement and manage the encryption, retrieval, and rotation of credentials. It does not leverage AWS services designed for secret management, leading to higher operational overhead.D. Store the credentials in AWS Systems Manager Parameter Store: - While Parameter Store can securely store credentials, it lacks built-in automatic rotation features like Secrets Manager. Implementing credential rotation would require additional effort and complexity, making it less ideal compared to Secrets Manager.Conclusion:Option C is the most effective solution for enhancing the security of the application with minimal programming effort while ensuring proper management and rotation of database credentials.