DOP-C02 Question 181
Single answerYou are deploying a containerized application on Amazon ECS using the Fargate launch type. The application requires sensitive database credentials to connect to an Amazon RDS instance. These credentials must be securely passed to the container. How should you configure your ECS task definition to achieve this?
- A
Store the credentials in an Amazon S3 bucket and mount the bucket as a volume in the ECS task.
- B
Use AWS Secrets Manager to store the credentials and reference the secret in the ECS task definition.
- C
Embed the credentials directly in the ECS task definition environment variables.
- D
Use an encrypted file in the container image that contains the credentials and decrypt it at runtime.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securely passing sensitive data like database credentials to ECS containers is to use AWS Secrets Manager. ECS allows you to reference secrets stored in Secrets Manager directly in the task definition. This ensures the credentials are securely fetched and injected into the container runtime without hardcoding them in the task definition or image.
- A. Incorrect.
Storing credentials in an Amazon S3 bucket and mounting it is not a secure practice for sensitive information like database credentials. Additionally, ECS does not support mounting S3 buckets directly.
- B. Correct.
AWS Secrets Manager is the recommended approach for storing and managing sensitive information securely. ECS supports referencing secrets from Secrets Manager in the task definition, ensuring the credentials are injected securely into the container.
- C. Incorrect.
Embedding credentials directly in the ECS task definition environment variables is a security risk, as task definitions are not encrypted and the credentials could be exposed to unauthorized users.
- D. Incorrect.
Using an encrypted file in the container image is not ideal because it requires adding decryption logic in the application and does not leverage AWS's managed services for secret management.