DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store the parameters in AWS Key Management Service (KMS) encrypted S3 buckets and use S3 Lifecycle policies to rotate the encryption keys every 30 days.

  Why it's wrong here

  S3 Lifecycle policies manage object storage, not secret rotation. KMS key rotation rotates the encryption key, but the underlying secret value remains unchanged. This does not meet the requirement to rotate the actual password. Additionally, Lambda functions cannot natively reference S3 objects as configuration without custom code. This approach is incorrect and adds unnecessary complexity.

• ✓

  Use AWS Secrets Manager to store the sensitive parameters and configure automatic rotation using a Lambda rotation function.

  Why this is correct

  AWS Secrets Manager natively supports automatic rotation of secrets using Lambda functions. It provides built-in rotation templates for databases like Amazon RDS, and you can schedule rotation every 30 days. This requires minimal development effort because the rotation logic is managed by Secrets Manager. The Lambda functions can retrieve secrets directly from Secrets Manager, and rotation is transparent. This is the most efficient solution.

• ✗

  Create a custom AWS Lambda function that generates new passwords and updates the Parameter Store parameters on a schedule using Amazon EventBridge.

  Why it's wrong here

  This approach requires writing and maintaining a custom Lambda function to generate passwords and update Parameter Store. You must also handle error cases, secure the function's permissions, and manage the schedule. While it achieves rotation, it involves significant development and operational overhead. Secrets Manager provides this functionality out-of-the-box, making it a less efficient choice.

• ✗

  Use AWS Systems Manager Automation to run a document that rotates the parameters and updates the Lambda functions' environment variables.

  Why it's wrong here

  Systems Manager Automation can run documents on a schedule, but it does not provide built-in secret rotation logic. You would need to author a custom automation document that generates new passwords, updates Parameter Store, and possibly updates Lambda environment variables. This is complex and error-prone. Secrets Manager is purpose-built for this use case and requires less effort.

Go deeper

Related to this question