Discuss Amazon DVA-C02 Exam Topic 1 Question 34

A company runs a payment application on Amazon EC2 instances behind an Application Load Balance The EC2 instances run in an Auto Scaling group across multiple Availability Zones The application needs to retrieve application secrets during the application startup and export the secrets as environment variables These secrets must be encrypted at rest and need to be rotated every month.

Which solution will meet these requirements with the LEAST development effort?

ASave the secrets in a text file and store the text file in Amazon S3 Provision a customer managed key Use the key for secret encryption in Amazon S3 Read the contents of the text file and read the export as environment variables Configure S3 Object Lambda to rotate the text file every month

BSave the secrets as strings in AWS Systems Manager Parameter Store and use the default AWS Key Management Service (AWS KMS) key Configure an Amazon EC2 user data script to retrieve the secrets during the startup and export as environment variables Configure an AWS Lambda function to rotate the secrets in Parameter Store every month.

CSave the secrets as base64 encoded environment variables in the application properties. Retrieve the secrets during the application startup. Reference the secrets in the application code. Write a script to rotate the secrets saved as environment variables.

DStore the secrets in AWS Secrets Manager Provision a new customer master key Use the key to encrypt the secrets Enable automatic rotation Configure an Amazon EC2 user data script to programmatically retrieve the secrets during the startup and export as environment variables

Suggested Answer: D

AWS Secrets Manager:Built for managing secrets, providing encryption, automatic rotation, and access control.

Customer Master Key (CMK):Provides an extra layer of control over encryption through AWS KMS.

Automatic Rotation:Enhances security by regularly changing the secret.

User Data Script:Allows secrets retrieval at instance startup and sets them as environment variables for seamless use within the application.

AWS Secrets Manager Documentation:https://docs.aws.amazon.com/secretsmanager/

AWS KMS Documentation:https://docs.aws.amazon.com/kms/

User Data for EC2 Instances:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html

Get Premium DVA-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

32 comments · newest first

Melynda 11 months ago

Parameter Store is solid, but I’d still prefer Secrets Manager for sensitive data.

Annita 11 months ago

Wait, can you really rotate secrets in S3 like that? Sounds sketchy.

Jacinta 11 months ago

I think A is way too complicated for what it needs to do.

Ty 11 months ago

I disagree, D looks more secure with automatic rotation.

Laurel 12 months ago

Option B seems like the easiest way to manage secrets with minimal effort.

Daniela 12 months ago

I vaguely remember that using environment variables directly isn't recommended for security reasons, so I think options A and C might not be ideal.

Mari 1 year ago

I practiced a similar question where we had to choose between S3 and Secrets Manager. I feel like Secrets Manager is the way to go here, but I’m not completely confident.

Darnell 1 year ago

I think option B sounds familiar; using Systems Manager Parameter Store seems like a simpler way to handle secrets, but I can't recall if it supports automatic rotation.

Rima 1 year ago

I remember we discussed using AWS Secrets Manager for managing secrets, but I'm not sure if it was the best option for this scenario.

Dana 1 year ago

I'm not sure about Option A with S3 and Object Lambda. That seems a bit more complex than the other options, and I'm not sure it's the "least development effort" solution.

Carmen 1 year ago

I'm leaning towards Option D with Secrets Manager. The automatic rotation feature is really appealing, and the user data script to export the secrets as environment variables is a nice way to handle that requirement.

Ria 1 year ago

Option B seems like the simplest approach to me. Using Systems Manager Parameter Store and the default KMS key should be straightforward, and the user data script to retrieve the secrets during startup is a nice touch.

Eugene 1 year ago

Hmm, I'm a bit confused by all the different AWS services mentioned. I'll need to carefully read through the question and options to make sure I understand the differences between them.

Sommer 1 year ago

This looks like a tricky question, but I think I can tackle it. The key is to find the solution that requires the least development effort while still meeting all the requirements.

Elizabeth 1 year ago

Okay, let me see here. If there's no dimension applied, it should default to the most common dimensions. I'm going to go with C - Hour or Days.

Barrett 2 years ago

Lol, Option A with the S3 text file rotation sounds like something my grandpa would come up with. 'Back in my day, we used to rotate secrets by hand, uphill both ways!'

Hollis 2 years ago

Option D with Secrets Manager looks good, but I'm not a fan of provisioning a new customer master key. Why not just use the default AWS KMS key like in Option B? Keeps things simple.

Virgilio 2 years ago

↳ replying to Hollis

I see your point. It really depends on how much control you want over the encryption and rotation process.

Lon 2 years ago

↳ replying to Hollis

True, but with Secrets Manager, you don't have to worry about managing the rotation process yourself.

Vanda 2 years ago

↳ replying to Hollis

But using the default AWS KMS key in Option B is simpler and requires less setup.

Gladis 2 years ago

↳ replying to Hollis

Option D with Secrets Manager is more secure though. It automatically rotates the secrets for you.

Julie 2 years ago

I'm not sure why anyone would want to manually rotate secrets as environment variables (Option C). That sounds like a maintenance nightmare waiting to happen. Option B is clearly the best choice here.

Roosevelt 2 years ago

I agree, Option B is the way to go. It minimizes the development effort and still meets all the requirements. Rotating the secrets in Parameter Store is a nice and convenient feature.

Avery 2 years ago

↳ replying to Roosevelt

Using AWS Systems Manager Parameter Store and AWS KMS key for encryption is a smart move. Option B is definitely the way to go.

Dottie 2 years ago

↳ replying to Roosevelt

I agree, Option B seems like the most efficient solution for this scenario.

Alease 2 years ago

↳ replying to Roosevelt

I think Option B is the best choice. It's simple and meets all the requirements.

Ollie 2 years ago

Option B seems like the easiest solution. Using Parameter Store and the default AWS KMS key is a straightforward way to manage the secrets, and the user data script and Lambda function for rotation are simple to set up.

Dorathy 2 years ago

↳ replying to Ollie

I agree, using Parameter Store and the default AWS KMS key makes it easy to manage secrets.

Tresa 2 years ago

↳ replying to Ollie

Option B is definitely the way to go. It's simple and efficient.

Annice 2 years ago

I prefer option B. Using AWS Systems Manager Parameter Store and AWS KMS key seems simpler to me.

Cordelia 2 years ago

I agree with Mitsue. Storing secrets in AWS Secrets Manager with automatic rotation is a good practice.

Mitsue 2 years ago

I think option D is the best choice. It's secure and requires the least development effort.

Amazon DVA-C02 Exam - Topic 1 Question 34 Discussion