AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

An organization runs microservices on Amazon ECS Fargate in three separate AWS accounts. Each service needs a database password that must be rotated every 30 days. The CloudOps team wants a centrally managed, encrypted store that allows cross-account retrieval with minimal code changes and supports automated rotation. Which solution meets these requirements?

Store the password in AWS Secrets Manager within a centralized security account, encrypt it with a customer-managed KMS key, enable a 30-day rotation schedule, and grant the ECS task execution roles in the other accounts access through a resource-based policy.
Upload the password as a client-side KMS-encrypted object to an S3 bucket in the security account and schedule an AWS Batch job to replace the object monthly.
Define the password as an encrypted environment variable in each ECS task definition and protect the cluster with AWS Shield Advanced.
Create an AWS Systems Manager Parameter Store SecureString in each account, encrypt it with the default AWS KMS key, and use an AWS Config rule to trigger a Lambda function that overwrites the parameter every 30 days.

Report Issue

Answer Description

AWS Secrets Manager is designed for centrally managing application secrets. A secret can be created in a dedicated security account, encrypted with a KMS customer-managed key, and shared with other AWS accounts by adding a resource-based policy to the secret. Secrets Manager provides native rotation templates that invoke an AWS Lambda function on a defined schedule, such as every 30 days. Systems Manager Parameter Store offers encryption but no built-in rotation; rotation would have to be scripted and maintained separately. Storing credentials in encrypted S3 objects or environment variables does not provide built-in rotation or granular cross-account access for individual reads, and using AWS Shield adds no secret-management capability. Therefore, using AWS Secrets Manager with cross-account sharing and scheduled rotation satisfies all operational and security requirements with the least overhead.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.