SAP-C02 Question 662
Single answerYour organization is running a microservices-based application using Amazon ECS with the Fargate launch type. The application requires access to sensitive configuration data (e.g., API keys and database credentials). These sensitive values must be securely stored, and the application containers must retrieve them dynamically at runtime. Additionally, the solution must ensure that secrets are not hardcoded into the container images or exposed in plaintext in the environment variables. Which solution should you implement?
- A
Store the sensitive data in an Amazon S3 bucket, encrypt it using an AWS KMS key, and have the application retrieve and decrypt the data at runtime.
- B
Use AWS Secrets Manager to store the sensitive data, and configure the ECS task execution role to allow access to the secrets.
- C
Hardcode the sensitive values into the Docker images used by the application and restrict access to the images in Amazon Elastic Container Registry (ECR).
- D
Use AWS Systems Manager Parameter Store with parameter encryption enabled, and configure ECS tasks to retrieve the parameters securely at runtime.
Show answer and explanation
Correct answer: B
Explanation
AWS Secrets Manager is the best solution for securely managing sensitive data like API keys and database credentials. It integrates seamlessly with Amazon ECS and Fargate, allowing the application to dynamically retrieve secrets at runtime without hardcoding them into container images. By associating the necessary permissions with the ECS task execution role, you ensure secure and controlled access to the secrets. This approach aligns with AWS security best practices and simplifies secrets management for containerized applications.
- A. Incorrect.
While storing sensitive data in an encrypted Amazon S3 bucket is secure, this option would require the application to handle decryption and access management manually. This is a more complex and less efficient option compared to purpose-built services like AWS Secrets Manager.
- B. Correct.
AWS Secrets Manager is designed for securely storing and retrieving sensitive data such as API keys and credentials. By configuring the ECS task execution role with access to Secrets Manager, the application can securely access the secrets without hardcoding them into images or exposing them in plaintext.
- C. Incorrect.
Hardcoding sensitive values into Docker images is a security risk because anyone with access to the images could extract the secrets. This approach does not align with best practices for secure secrets management.
- D. Incorrect.
AWS Systems Manager Parameter Store can securely store sensitive data, but it is less feature-rich compared to AWS Secrets Manager for managing secrets (e.g., automatic rotation of secrets). While this option is viable, AWS Secrets Manager is more suitable for this use case due to its advanced features.