SAP-C02 Question 629
Single answerA company is running a microservices-based application on Amazon ECS using the Fargate launch type. The application requires access to sensitive configuration data, such as API keys, database credentials, and encryption secrets. The company wants to follow AWS best practices for securely managing these sensitive data while minimizing operational overhead. Which solution should you recommend?
- A
Store the sensitive data as environment variables within the ECS task definition.
- B
Use AWS Secrets Manager to store sensitive data and configure the ECS task to retrieve secrets at runtime.
- C
Store the sensitive data in an Amazon S3 bucket and grant the ECS task execution role permissions to access the bucket.
- D
Embed the sensitive data directly into the container image at build time.
Show answer and explanation
Correct answer: B
Explanation
The best practice for managing sensitive data in AWS is to use AWS Secrets Manager. It provides secure storage, automatic rotation, and fine-grained access control for secrets, ensuring that sensitive information like API keys and database credentials can be accessed securely by the ECS task at runtime without being hard-coded or exposed in plaintext. This approach minimizes operational overhead and enhances the security posture of the application.
- A. Incorrect.
Storing sensitive data as environment variables in the ECS task definition is not secure because the sensitive values are visible in plaintext in the AWS Management Console and API calls. This approach does not follow AWS security best practices.
- B. Correct.
Using AWS Secrets Manager to store sensitive data is the recommended solution. Secrets Manager allows you to securely store, rotate, and retrieve secrets at runtime, adhering to AWS best practices for managing sensitive information.
- C. Incorrect.
Storing sensitive data in an Amazon S3 bucket is not ideal for this use case, as it requires additional effort to secure the data and manage access control. While possible, it does not provide secret-specific features like rotation or encryption tailored for secrets.
- D. Incorrect.
Embedding sensitive data directly into the container image at build time is highly insecure because it exposes the data to anyone with access to the image, and it complicates secret management and rotation.