SAP-C02 Question 414
Single answerYou are designing a multi-account AWS environment for a financial services company. The company requires secure storage and rotation of database credentials for applications running in multiple AWS accounts. These applications need to retrieve credentials dynamically at runtime. The solution must ensure that only specific applications in each account have access to the credentials, and credentials must be rotated automatically every 30 days. Which solution meets these requirements?
- A
Use AWS Secrets Manager to store the credentials. Configure resource-based policies on the secrets to grant access to specific applications in each account and enable automatic rotation for the secrets.
- B
Store the credentials in AWS Systems Manager Parameter Store with encryption. Use IAM policies to control access to the parameters and set up a Lambda function to rotate credentials every 30 days.
- C
Store the credentials in an Amazon S3 bucket encrypted with a customer-managed KMS key. Use bucket policies to restrict access to specific applications in each account, and schedule a daily script to rotate credentials.
- D
Use AWS Key Management Service (KMS) to store the credentials. Configure IAM policies to restrict access to the KMS keys and implement a custom solution for credential rotation.
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the recommended service for securely managing secrets such as database credentials. It provides built-in support for automatic rotation, fine-grained access control through resource-based policies, and cross-account access management. These features make it the ideal choice for securely managing secrets in a multi-account environment while meeting the requirements of automatic rotation and restricted access.
- A. Correct.
This option is correct. AWS Secrets Manager is designed specifically for secrets management, including secure storage, fine-grained access control through resource-based policies, and built-in automatic rotation of secrets.
- B. Incorrect.
This option is partially correct but not optimal. While AWS Systems Manager Parameter Store can store encrypted parameters, it does not support automatic rotation natively. You would need to build and manage a custom rotation solution using Lambda, which increases complexity.
- C. Incorrect.
This option is incorrect. Storing credentials in S3, even if encrypted, is not a best practice for secrets management. S3 bucket policies are not designed for fine-grained access to secrets, and managing credential rotation through scripts is cumbersome and error-prone.
- D. Incorrect.
This option is incorrect. AWS KMS is meant for encryption key management, not for storing and managing secrets. Implementing a custom solution for credential rotation would require additional effort and is not aligned with best practices.