Q29 — AWS SAP-C02 Ch.2

Question 29 of 75 | ← Chapter 2

Q179. A company is deploying AWS Lambda functions that access an Amazon RDS for PostgreSQL database. The company needs to launch the Lambda functions in a QA environment and in a production environment. The company must not expose credentials within application code and must rotate passwords automatically. Which solution will meet these requirements?

• A. Store the database credentials for both environments in AWS Systems Manager Parameter Store. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key Within the application code of the Lambda functions, pull the credentials from the Parameter Store parameter by using the AWS SDK for Python (Boto3). Add a role to the Lambda functions to provide access to the Parameter Store parameter
• B. Store the database credentials for both environments in AWS Secrets Manager with distinct key entry for the QA environment and the production environment. Turn on rotation Provide a reference to the Secrets Manager key as an environment variable for the Lambda functions ✓
• C. Store the database credentials for both environments in AWS Key Management Service (AWS KMS). Turn on rotation. Provide a reference to the credentials that are stored in AWS KMS as an environment variable for the Lambda functions
• D. Create separate S3 buckets for the QA environment and the production environment. Turn on server- side encryption with AWS KMS keys (SSE-KMS) for the S3 buckets. Use an object naming pattern that gives each Lambda function's application code the ability to pull the correct credentials for the function's corresponding environment. Grant each Lambda function's execution role access to Amazon S3

Correct Answer: B. Store the database credentials for both environments in AWS Secrets Manager with distinct key entry for the QA environment and the production environment. Turn on rotation Provide a reference to the Secrets Manager key as an environment variable for the Lambda functions

Explanation

This solution involves storing the database credentials for both environments (QA and production) in AWS Secrets Manager, which provides a secure and scalable way to store secrets such as passwords. The Secrets Manager can be configured to turn on automatic password rotation, which meets the requirement of automatically rotating passwords. Distinct keys can be used to separate the credentials for each environment. The Lambda functions can reference the Secrets Manager keys by using environment variables, which ensures that the credentials are not exposed within the application code. This solution is also easier to manage and scale as additional Lambda functions and environments are added, simplifying the management of secrets across multiple services.