Secrets management (Vault, AWS Secrets Manager) in Microservices - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does AWS Secrets Manager handle secret rotation?

A microservice uses AWS Secrets Manager to store database credentials. What happens when automatic rotation is enabled?

A AWS Secrets Manager deletes the old secret and creates a new secret with a different name.

B AWS Secrets Manager updates the secret value and triggers a Lambda function to update the database credentials accordingly.

C AWS Secrets Manager requires manual update of the secret value by the user every time rotation is needed.

D AWS Secrets Manager disables the secret temporarily during rotation to prevent access.

💡 Hint

Think about how automation helps keep secrets fresh without downtime.

AWS Secrets Manager automates secret rotation by updating the secret value and invoking a Lambda function to update the credentials in the target service, ensuring seamless and secure rotation.

❓ Architecture

intermediate

Best practice for microservices accessing Vault secrets

You have multiple microservices that need to access secrets stored in HashiCorp Vault. What is the best way to manage access securely?

A Each microservice authenticates to Vault using its own unique identity and requests only the secrets it needs.

B Microservices store Vault root token locally and use it to access any secret.

C All microservices share a single Vault token with full access to all secrets.

D Microservices access secrets by reading Vault's storage backend files directly.

💡 Hint

Consider the principle of least privilege and identity separation.

Each microservice should authenticate with Vault using its own identity and have permissions scoped to only the secrets it requires. This limits risk if one service is compromised.

❓ security

advanced

What error occurs if a microservice tries to access a revoked AWS Secrets Manager secret?

A microservice tries to retrieve a secret from AWS Secrets Manager, but the secret has been revoked or deleted. What error will the microservice receive?

A ResourceNotFoundException

B AccessDeniedException

C InvalidParameterException

D ThrottlingException

💡 Hint

Think about what happens when a requested resource does not exist.

If the secret is revoked or deleted, AWS Secrets Manager returns a ResourceNotFoundException indicating the secret cannot be found.

🧠 Conceptual

advanced

Why use dynamic secrets in Vault for database credentials?

Vault can generate dynamic database credentials on demand. What is the main advantage of this approach compared to static secrets?

A Dynamic secrets allow storing credentials in plain text files for easy access.

B Dynamic secrets are cached indefinitely to improve performance.

C Dynamic secrets require manual rotation by the administrator every week.

D Dynamic secrets reduce the risk of long-term credential exposure by having short lifetimes and automatic revocation.

💡 Hint

Think about how temporary credentials improve security.

Dynamic secrets are generated with limited lifetime and automatically revoked after use, reducing the risk if credentials are leaked.

✅ Best Practice

expert

How to securely provide AWS IAM permissions for microservices to access Secrets Manager?

You want to allow a microservice running on AWS ECS to access specific secrets in AWS Secrets Manager. Which approach follows best security practices?

A Use the root AWS account credentials in the microservice to access Secrets Manager.

B Embed AWS access keys with full Secrets Manager access inside the microservice container environment variables.

C Assign an IAM role to the ECS task with a policy granting least privilege access to only required secrets.

D Grant Secrets Manager full access to all ECS tasks in the AWS account.

💡 Hint

Consider AWS best practices for credentials and permissions.

Assigning an IAM role to the ECS task with least privilege permissions avoids hardcoding credentials and limits access scope, improving security.