Q76 — AWS SAA-C03 Ch.17

Question 76 of 89 | ← Chapter 17

Q1376. A company has an application that runs on Amazon EC2 instances in an Auto Scaling group. The application uses hardcoded credentials to access an Amazon RDS database.To comply with new regulations, the company needs to automatically rotate the database password for the application service account every 90 days.Which solution will meet these requirements?

Correct Answer: B. Create a secret for the database credentials in AWS Secrets Manager. Schedule an AWS Lambda function in Secrets Manager to rotate the secret every 90 days. Modify the application to read the database credentials from Secrets Manager.

Explanation

Let's analyze each option to determine which one meets the requirement of automatically rotating the database password for the application service account every 90 days:Option ALambda function for password generation: Creating an AWS Lambda function to generate new randomized passwords and using an Amazon EventBridge rule to invoke it every 90 days is a valid approach for generating passwords on a schedule.Uploading via SSH: However, configuring the Lambda function to upload a JSON file containing the new password to existing EC2 instances using SSH is a security risk and not a recommended practice. SSH access requires managing keys, and exposing the instances in this way can lead to potential security breaches. Also, it is not a scalable or reliable method for updating credentials across multiple instances in an Auto Scaling group. So, this option is incorrect.Option BAWS Secrets Manager: AWS Secrets Manager is a service that helps you protect access to your applications, services, and IT resources. You can store and manage secrets such as database credentials, API keys, and other sensitive information.Secret rotation: By creating a secret for the database credentials in Secrets Manager and scheduling an AWS Lambda function (which can be easily configured within Secrets Manager) to rotate the secret every 90 days, you can automate the password rotation process.Application modification: Modifying the application to read the database credentials from Secrets Manager ensures that the application always uses the most up - to - date credentials without hardcoding them. This is a secure, scalable, and compliant solution that meets the requirement. So, this option is correct.Option CAmazon ECS task for password generation: Creating a new Amazon ECS task to generate new randomized passwords and configuring it to launch every 90 days is a possible way to generate passwords on a schedule.Uploading via SSH: Similar to Option A, configuring the task to upload a JSON file containing the new password to existing EC2 instances using SSH is a security risk. It is not a recommended way to distribute credentials, especially in a dynamic environment like an Auto Scaling group. So, this option is incorrect.Option DNew EC2 instance with cron job: Creating a new EC2 instance that runs a cron job every 90 days to generate new randomized passwords adds unnecessary infrastructure and complexity. Managing an additional EC2 instance just for password generation is not cost - effective or efficient. Uploading via SSH: Configuring the new EC2 instance to upload a JSON file containing the new password to existing EC2 instances using SSH also has the same security risks as the previous options that use SSH for credential distribution. So, this option is incorrect. Therefore, the solution that will meet the requirements is to create a secret for the database credentials in AWS Secrets Manager, schedule an AWS Lambda function in Secrets Manager to rotate the secret every 90 days, and modify the application to read the database credentials from Secrets Manager, and the answer is B.