DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Pass secrets as environment variables in the task definition.

  Why it's wrong here

  Passing secrets as environment variables is a significant security risk because these variables are not encrypted at rest within the task definition and can be easily exposed. They are often visible in process listings, application logs, or through container inspection tools, making them vulnerable to unauthorized access. This method also lacks built-in rotation capabilities and fine-grained access control.

• ✗

  Store secrets in an encrypted S3 bucket and have the application download them at startup.

  Why it's wrong here

  Storing secrets in an encrypted S3 bucket introduces unnecessary complexity and potential exposure. While S3 provides encryption, the application would still need to be granted IAM permissions to access the bucket, and the credentials for this access would themselves become a new secret management problem. This approach requires custom code for retrieval and decryption, increasing the operational overhead and attack surface compared to dedicated secret management services.

• ✓

  Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store and retrieve secrets.

  Why this is correct

  AWS Systems Manager Parameter Store (specifically Secure String parameters) and AWS Secrets Manager are purpose-built services designed for the secure storage, retrieval, and rotation of sensitive information. They integrate natively with AWS Key Management Service (KMS) for encryption at rest and AWS Identity and Access Management (IAM) for fine-grained access control, providing a robust and compliant solution for managing secrets in a microservices architecture.

• ✗

  Use an AWS Lambda function to generate secrets and store them in DynamoDB.

  Why it's wrong here

  Using an AWS Lambda function to generate secrets and store them in DynamoDB introduces significant architectural complexity and security challenges. DynamoDB, while encrypted at rest, lacks the native secret management features such as automatic rotation, versioning, and secure retrieval mechanisms that dedicated services provide. This custom solution would require extensive development, auditing, and maintenance to achieve a comparable security posture.

Go deeper

Related to this question