Secret management integration (Vault, Secrets Manager) in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does AWS Secrets Manager handle secret rotation?

A developer configures AWS Secrets Manager to rotate a database password automatically every 30 days. What happens during the rotation process?

A Secrets Manager only updates the secret value in the console but does not change the database password.

B Secrets Manager deletes the old secret and creates a completely new secret with a new name.

C Secrets Manager creates a new secret version, updates the database with the new password, and marks the new version as current.

D Secrets Manager sends an email notification to the admin but does not change the secret or database password.

💡 Hint

Think about how the secret and the service using it stay in sync during rotation.

During rotation, Secrets Manager creates a new version of the secret, updates the database password to match, and then marks the new version as current so applications use the updated secret seamlessly.

❓ Configuration

intermediate

Terraform: Correct Vault provider configuration for AWS authentication

Which Terraform configuration snippet correctly sets up the Vault provider to authenticate using AWS IAM role?

A

provider "vault" {
  auth_login {
    path = "auth/aws/login"
    parameters = {
      role = "my-role"
    }
  }
}

B

provider "vault" {
  auth_method = "aws"
  role = "my-role"
}

C

provider "vault" {
  auth {
    method = "aws"
    role = "my-role"
  }
}

D

provider "vault" {
  aws_auth {
    role = "my-role"
  }
}

💡 Hint

Look for the correct block and keys used in Vault provider for AWS login.

The Vault provider uses the auth_login block with path set to auth/aws/login and parameters including the role name for AWS IAM authentication.

❓ Architecture

advanced

Designing secure secret access for microservices using Vault

You have multiple microservices running in Kubernetes that need to access different secrets stored in Vault. Which architecture ensures least privilege and automatic secret renewal?

A Embed Vault root token in each microservice container environment variables for easy access.

B Assign each microservice a unique Vault Kubernetes service account role with policies scoped to only required secrets, and use Vault Agent sidecar for automatic token renewal.

C Store secrets in Kubernetes ConfigMaps and let microservices read them directly without Vault integration.

D Use a single Vault token shared by all microservices with full access to all secrets, and manually update tokens when expired.

💡 Hint

Think about security best practices for secret access and token management.

Assigning unique roles with scoped policies limits access to only needed secrets. Vault Agent sidecar handles token renewal automatically, improving security and reliability.

❓ security

advanced

Identifying security risk in secret management configuration

Which Terraform snippet introduces a security risk when managing AWS Secrets Manager secrets?

resource "aws_secretsmanager_secret" "db_password" {
  name = "db_password"
}

resource "aws_secretsmanager_secret_version" "db_password_version" {
  secret_id     = aws_secretsmanager_secret.db_password.id
  secret_string = var.db_password
}

A Not specifying a KMS key for encryption, so AWS uses default encryption.

B Using <code>secret_string</code> instead of <code>secret_binary</code> for the secret value.

C Not tagging the secret resource with environment metadata.

D Storing the secret value directly in Terraform variable <code>var.db_password</code> which may be logged or stored in state files.

💡 Hint

Consider where secret values are stored and risks of exposure.

Storing secrets directly in Terraform variables risks exposure in logs and state files. Best practice is to use external secret injection or encrypted storage for sensitive values.

✅ Best Practice

expert

Choosing the best secret injection method for serverless functions

You deploy AWS Lambda functions that require database credentials stored in AWS Secrets Manager. Which approach follows best practices for secret injection and minimizes cold start latency?

A Configure Lambda environment variables with the secret ARN and fetch secrets at runtime using AWS SDK with caching inside the function.

B Hardcode the database credentials inside the Lambda function code for faster access.

C Fetch the secret from Secrets Manager on every function invocation without caching.

D Store the secret in an S3 bucket and read it from Lambda at runtime.

💡 Hint

Think about balancing security, performance, and cold start impact.

Passing the secret ARN as an environment variable and fetching the secret with caching reduces latency and avoids hardcoding secrets, following security best practices.