DVA-C02 Question 221
Select 2A developer is working on an application that requires secure access to configuration data and sensitive credentials such as database passwords. The application is deployed on Amazon ECS, and the developer wants to ensure that configuration changes can be rolled out dynamically without redeploying the application. Which combination of services can the developer use to meet these requirements?
- A
AWS AppConfig for dynamic configuration updates and AWS Secrets Manager for secure storage of sensitive data
- B
AWS AppConfig for secure storage of credentials and AWS Parameter Store for dynamic configuration updates
- C
AWS Secrets Manager for secure storage of sensitive data and AWS Parameter Store for application configuration data
- D
AWS Systems Manager Parameter Store for both dynamic configuration updates and secure storage of sensitive data
- E
Amazon S3 for storing configuration files and AWS Secrets Manager for storing sensitive credentials
Show answer and explanation
Correct answers: A, C
Explanation
AWS AppConfig and AWS Secrets Manager together provide a comprehensive solution for dynamic configuration management and secure storage of sensitive credentials. AWS AppConfig can dynamically roll out application configuration changes without redeploying the application, while AWS Secrets Manager is designed to securely manage sensitive data like database passwords. Alternatively, AWS Secrets Manager and AWS Parameter Store can be used together, where Parameter Store handles configuration data, and Secrets Manager manages sensitive credentials. Other options either misuse services or lack key capabilities for the given scenario.
- A. Correct.
Correct: AWS AppConfig is designed for dynamic configuration management, and AWS Secrets Manager is ideal for securely storing and accessing sensitive data like database credentials.
- B. Incorrect.
Incorrect: AWS AppConfig is not designed for secure storage of credentials; it is used for dynamic configuration management. AWS Parameter Store can manage configuration data but does not provide the same level of secure secret handling as Secrets Manager.
- C. Correct.
Correct: AWS Secrets Manager is a dedicated service for managing sensitive credentials, and AWS Parameter Store can store application configuration data. This combination can address the requirements.
- D. Incorrect.
Incorrect: While AWS Systems Manager Parameter Store can store configuration and sensitive data, it does not provide the advanced secret lifecycle management and rotation features of AWS Secrets Manager, nor does it specifically support dynamic configuration rollout.
- E. Incorrect.
Incorrect: Amazon S3 can store configuration files but lacks the dynamic configuration rollout capabilities of AWS AppConfig. AWS Secrets Manager is appropriate for sensitive credentials but does not address configuration updates.