Secrets Manager for credentials in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does AWS Secrets Manager rotate credentials automatically?

A developer wants AWS Secrets Manager to automatically rotate database credentials every 30 days. Which mechanism enables this automatic rotation?

A By configuring a Lambda rotation function linked to the secret that updates credentials on schedule

B By manually updating the secret value every 30 days in the console

C By enabling automatic rotation in IAM user settings

D By setting a CloudWatch alarm to notify when credentials expire

💡 Hint

Think about how AWS Secrets Manager can run code to update credentials without manual intervention.

AWS Secrets Manager uses Lambda functions to perform automatic rotation. You link a Lambda rotation function to the secret, and Secrets Manager runs it on the schedule you set to update credentials securely.

❓ security

intermediate

Which IAM policy grants least privilege to read a specific secret?

You want to allow an application to read only one secret named prod/db-password from AWS Secrets Manager. Which IAM policy snippet grants the least privilege?

A {"Effect":"Allow","Action":"secretsmanager:GetSecretValue","Resource":"*"}

B {"Effect":"Allow","Action":"secretsmanager:GetSecretValue","Resource":"arn:aws:secretsmanager:region:account-id:secret:prod/db-password-*"}

C {"Effect":"Allow","Action":"secretsmanager:*","Resource":"*"}

D {"Effect":"Allow","Action":["secretsmanager:GetSecretValue","secretsmanager:DescribeSecret"],"Resource":"arn:aws:secretsmanager:region:account-id:secret:prod/db-password-*"}

💡 Hint

Least privilege means only needed actions on only the specific secret.

Option D allows only the necessary actions to read and describe the specific secret resource. Other options are either too broad or allow all actions.

❓ Architecture

advanced

Designing secure access to secrets for multiple microservices

You have multiple microservices running on AWS ECS that need access to different secrets stored in AWS Secrets Manager. What is the best architecture to securely provide each microservice access only to its required secrets?

A Create one IAM role per microservice with permissions scoped to only its secrets, and assign the role to the ECS task

B Store all secrets in one secret and share it with all microservices

C Use a single IAM role for all microservices with permissions to all secrets

D Embed secrets directly in the container images for each microservice

💡 Hint

Think about isolating permissions per microservice to follow security best practices.

Assigning one IAM role per microservice with scoped permissions ensures each service can only access its own secrets, reducing risk if one service is compromised.

❓ Configuration

advanced

What is the correct AWS CLI command to retrieve a secret value?

You want to retrieve the plaintext value of a secret named prod/api-key using AWS CLI. Which command will return only the secret string?

A aws secretsmanager get-secret-value --secret-id prod/api-key

B aws secretsmanager describe-secret --secret-id prod/api-key

C aws secretsmanager get-secret-value --secret-id prod/api-key --query SecretString --output text

D aws secretsmanager list-secrets --filters Key=name,Values=prod/api-key

💡 Hint

Focus on extracting only the secret string, not metadata.

The command in option C uses --query to extract only the SecretString field and outputs it as plain text, which is the secret value.

✅ Best Practice

expert

Ensuring secure secret access in a multi-account AWS environment

Your company uses multiple AWS accounts for development, testing, and production. You want to centralize secret management in one account but allow secure read access to secrets from other accounts. What is the best practice to achieve this?

A Use AWS S3 buckets with public read access to store secrets

B Use resource-based policies on secrets in the central account to allow cross-account IAM roles from other accounts to access secrets

C Share IAM users across accounts with the same credentials

D Copy secrets manually to each account and manage them separately

💡 Hint

Think about how AWS Secrets Manager supports cross-account access securely.

Resource-based policies on secrets allow you to grant cross-account access securely without duplicating secrets or sharing credentials. This is the recommended best practice.