Secrets Manager

Question 1

What AWS service provides secure storage, automatic rotation, and fine-grained access control for secrets such as database credentials, API keys, and other sensitive information?

Answer 1

AWS Secrets Manager

Question 2

How frequently can AWS Secrets Manager rotate secrets?

Answer 2

As often as every 4 hours, up to a maximum of 999 days

Question 3

What access methods are available for managing secrets in AWS Secrets Manager?

Answer 3

• Console
• CLI
• API
• SDK

Question 4

What AWS service does Secrets Manager use to perform automatic secret rotation?

Answer 4

AWS Lambda

Question 5

What is the sequence of steps involved when an application retrieves and uses database credentials managed by AWS Secrets Manager?

Answer 5

1. The application uses SDK to interact with Secrets Manager
2. Secrets Manager uses IAM to authorise the Application
3. Once authorized Secrets Manager returns database credentials to the application
4. The application uses credentials to connect to the database
5. At some point in time, the secret manager will rotate credentials

Question 6

What AWS service does Secrets Manager use to encrypt secrets at rest?

Answer 6

AWS KMS

KMS permissions are also required

Question 7

What are the main features of AWS Secrets Manager?

Answer 7

• Secure storage of secrets (passwords, API Keys)
• Automatic rotation
• Application integration
• Direct integration with AWS services like RDS

Question 8

Which AWS Secrets Manager API is used to re-encrypt a secret with a new KMS key after rotating or modifying the Customer Master Key (CMK)?

Answer 8

 UpdateSecret

Question 9

What happens if the old KMS CMK is deleted before calling UpdateSecret on a secret in AWS Secrets Manager?

Answer 9

The secret becomes undecryptable and its contents are permanently lost

Question 10

Which parameter must be used with the AWS CLI DeleteSecret command to delete a Secrets Manager secret immediately without a recovery window?

Answer 10

• --force-delete-without-recovery
• ForceDeleteWithoutRecovery

Question 11

Which AWS services have built-in secret rotation support in AWS Secrets Manager?

Answer 11

• Amazon RDS
• Amazon DocumentDB
• Amazon Redshift