SOA-C02 Question 220
Single answerA company is developing an application that requires access to a database password stored securely. The application is hosted on Amazon EC2 instances within an Auto Scaling group. The company wants to securely store the database password and allow the EC2 instances to retrieve it dynamically without hardcoding secrets in the application code. Which solution will securely meet these requirements?
- A
Use AWS Secrets Manager to store the database password and configure an IAM role for the EC2 instances to retrieve the secret.
- B
Store the database password in an encrypted file on an Amazon S3 bucket and grant EC2 instances access using bucket policies.
- C
Use AWS Systems Manager Parameter Store with a SecureString type to store the database password and create an IAM role for the EC2 instances to access the parameter.
- D
Store the database password in the EC2 instance's user data script and retrieve it during the instance launch.
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the most secure and efficient solution for managing secrets like database passwords. It provides features such as secret rotation, fine-grained access control, and integration with IAM roles. By associating an IAM role with the EC2 instances, you can dynamically retrieve the secret without hardcoding it, meeting security and operational best practices.
- A. Correct.
This is the correct answer. AWS Secrets Manager is specifically designed for securely storing and retrieving secrets such as database passwords. By using an IAM role associated with the EC2 instances, you can securely retrieve the secret without hardcoding it into the application.
- B. Incorrect.
This option is less secure because storing sensitive information in an S3 bucket, even if encrypted, requires additional management and configuration to ensure security and cannot provide the same level of secret rotation and access control as AWS Secrets Manager.
- C. Incorrect.
While AWS Systems Manager Parameter Store with SecureString can securely store secrets, AWS Secrets Manager is the recommended service for managing secrets like database passwords due to its additional features such as automatic secret rotation.
- D. Incorrect.
Storing secrets in user data scripts is insecure as the user data script is accessible and can be retrieved after instance launch, potentially exposing the database password.