SAA-C03 Question 9
Single answerA company is deploying a new application using Amazon ECS with Fargate. The application requires sensitive database credentials to connect to an Amazon RDS instance. The company wants to securely manage these credentials without hardcoding them into the application code or storing them in the container image. What is the BEST way to achieve this?
- A
Store the credentials in an Amazon S3 bucket and grant the ECS task permissions to access the bucket.
- B
Use AWS Secrets Manager to store the credentials and configure the ECS task definition to retrieve the secrets at runtime.
- C
Embed the credentials directly into the ECS task definition as environment variables.
- D
Encrypt the credentials using AWS KMS and include the encrypted values in the container image.
Show answer and explanation
Correct answer: B
Explanation
AWS Secrets Manager is the best solution for securely managing sensitive information such as database credentials. It integrates with Amazon ECS, allowing applications to retrieve secrets at runtime without exposing them in plain text or hardcoding them. This approach also supports automated secret rotation and provides robust security controls.
- A. Incorrect.
Storing sensitive credentials in Amazon S3 is not a secure approach, even if permissions are restricted. This option does not provide the required level of security for sensitive data like database credentials.
- B. Correct.
AWS Secrets Manager is the recommended option for securely storing and retrieving sensitive information like database credentials. It integrates seamlessly with ECS task definitions, allowing tasks to retrieve the credentials securely at runtime.
- C. Incorrect.
Embedding sensitive credentials directly into the ECS task definition as environment variables is insecure because it exposes the credentials in plain text and increases the risk of unauthorized access.
- D. Incorrect.
Including encrypted credentials in the container image is not a secure or scalable solution. It requires additional steps to decrypt the credentials at runtime and risks exposing the decryption keys.