DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store the credentials in a Systems Manager Parameter Store parameter and retrieve them at application startup.

  Why it's wrong here

  While AWS Systems Manager Parameter Store can securely store sensitive information as Secure Strings, it does not inherently provide automatic rotation capabilities for database credentials. Retrieving secrets only at application startup means the application holds the secret for its entire operational lifecycle, increasing the window of vulnerability if the instance is compromised. This approach would necessitate custom automation or manual processes for credential rotation, which is less robust and more error-prone than a dedicated secrets management service.

• ✗

  Store the credentials in an encrypted S3 bucket and have the application read the config file at startup.

  Why it's wrong here

  Storing credentials directly in a configuration file within an encrypted S3 bucket, even with strong access controls, still means the secret must be downloaded and stored locally on the EC2 instance. This creates a potential exposure point if the instance's file system is compromised. Furthermore, S3 itself does not offer built-in mechanisms for automatic secret rotation, making the management and lifecycle of these credentials a complex, manual, and error-prone process that deviates from best practices for dynamic secret management.

• ✗

  Hardcode the credentials in a Lambda function that is called to get the credentials.

  Why it's wrong here

  Hardcoding sensitive credentials directly within a Lambda function's code or environment variables is a critical security anti-pattern. This practice embeds the secret directly into the deployment package, making it easily discoverable by anyone with access to the code repository or deployment artifacts. It also severely complicates credential rotation, requiring code changes, testing, and redeployment for every update, which is inefficient, prone to errors, and increases the risk of downtime or security incidents.

• ✓

  Use AWS Secrets Manager to store the credentials and retrieve them at runtime with automatic rotation.

  Why this is correct

  AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving database credentials, API keys, and other secrets throughout their lifecycle. It integrates directly with various AWS services and databases to provide robust automatic rotation, ensuring credentials are regularly updated without manual intervention. Retrieving secrets at runtime, rather than just at startup, minimizes the exposure window and allows for dynamic credential updates without requiring application restarts, significantly enhancing the overall security posture.

Go deeper

Related to this question