Three Methods to Securely Pass Credentials to ECS Fargate Tasks
A developer is deploying a containerized application on Amazon ECS with Fargate. The application requires access to an Amazon RDS database. The developer needs to securely pass database credentials to the container. Which THREE methods can the developer use?
Quick Answer
The answer is to use IAM roles for tasks and retrieve credentials from AWS Secrets Manager at runtime, along with storing credentials in AWS Systems Manager Parameter Store or using IAM database authentication for RDS. These three methods are correct because they eliminate hardcoded secrets and leverage AWS’s native security services to grant temporary, scoped access—IAM roles for tasks provide an identity to the container, while Secrets Manager and Parameter Store encrypt credentials at rest and in transit, allowing the application to fetch them securely at startup. On the AWS Certified Developer Associate DVA-C02 exam, this question tests your understanding of the shared responsibility model and the principle of least privilege; a common trap is assuming environment variables in the task definition are safe, but they are stored in plain text and visible in the AWS console. Remember the mnemonic “I SPY” for IAM roles, Secrets Manager, Parameter Store, and IAM database auth—four secure paths, but only three fit this scenario.
⚠ Common exam trap
Many exam-takers confuse 'referencing a secret in the task definition' (which is secure and done at launch time) with 'defining environment variables directly in the task definition' (which is insecure), and they may also overlook that IAM roles for tasks can be used to retrieve secrets at runtime, not just at launch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.
AWS Systems Manager Parameter Store allows you to securely store database credentials as parameters and reference them directly in the ECS task definition using the 'secrets' field. This enables Fargate to inject the credentials as environment variables at container startup without exposing them in plaintext.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.
Why this is correct
Parameter Store can securely store and inject secrets.
- ✓
Store the credentials in AWS Secrets Manager and reference the secret in the task definition.
Why this is correct
Secrets Manager integrates with ECS to inject secrets securely.
- ✓
Use IAM roles for tasks and retrieve credentials from AWS Secrets Manager at runtime.
Why this is correct
The task can assume an IAM role to access Secrets Manager.
- ✗
Hardcode the credentials in the container image.
Why it's wrong here
Hardcoding is insecure and not recommended.
- ✗
Define environment variables in the task definition with the credentials.
Why it's wrong here
Environment variables in task definitions are visible in plain text.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is deploying a containerized application on Amazon ECS with Fargate. The application needs to read configuration data from AWS Systems Manager Parameter Store. The developer wants to ensure that the ECS task definition can access the parameter without hardcoding the value. What should the developer do?
hard- A.Store the configuration in Amazon ECR as a label and reference it in the task definition.
- B.Use the 'configs' section in the task definition to load from Parameter Store.
- C.Add a 'parameters' section in the task definition to load from Parameter Store.
- ✓ D.Use the 'secrets' field in the task definition to reference the parameter ARN.
Why D: The 'secrets' field in an ECS task definition allows you to reference AWS Systems Manager Parameter Store (or AWS Secrets Manager) parameters by their ARN. This enables the container to retrieve the configuration value at runtime without hardcoding it in the task definition or container image, maintaining security and flexibility.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.