DVA-C02 Deployment Practice Question
A developer is deploying a Docker container to Amazon ECS using the Fargate launch type. The developer wants to ensure the container has access to an Amazon RDS database. What is the best way to securely pass the database credentials to the container?
⚠ Common exam trap
Test-takers frequently think environment variables are inherently secure or that storing credentials in S3 is a safe alternative, overlooking the native integration and security guarantees of AWS Secrets Manager and Parameter Store for ECS tasks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store the credentials and reference them in the task definition.
AWS Systems Manager Parameter Store and AWS Secrets Manager are designed to securely store and manage sensitive information like database credentials. In Amazon ECS with Fargate, you can reference these secrets directly in the task definition using the 'secrets' parameter, which injects them as environment variables at runtime without exposing them in plain text or requiring additional code to fetch them. This approach adheres to the principle of least privilege and integrates natively with IAM roles for secure access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pass the credentials as plain text environment variables in the task definition.
Why it's wrong here
Passing credentials as plain text environment variables directly within an ECS task definition is a critical security vulnerability. These secrets are visible to anyone with appropriate IAM permissions to view task definitions, are stored unencrypted in ECS service events, and can easily be exposed in logs or debugging interfaces. This method completely bypasses secure secret management practices and significantly increases the risk of unauthorized access to sensitive information.
- ✗
Store the credentials in an Amazon S3 bucket and download them at container startup.
Why it's wrong here
Storing credentials in an Amazon S3 bucket and downloading them at container startup introduces significant security and operational complexities. The container would still require separate credentials to access the S3 bucket, creating a bootstrap problem for secure secret retrieval. Furthermore, the secret would be downloaded to the container's ephemeral filesystem, increasing its exposure surface, and managing granular access control for individual secrets within S3 is less robust than dedicated secret management services.
- ✗
Store the credentials in the container image as environment variables.
Why it's wrong here
Embedding credentials directly into a Docker container image as environment variables is a severe security vulnerability. Once part of an image layer, these secrets become permanently accessible to anyone who can pull and inspect the image, such as from Amazon ECR. This approach makes credential rotation extremely difficult, requiring a full image rebuild and redeployment, and violates the principle of not baking secrets into immutable artifacts.
- ✓
Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store the credentials and reference them in the task definition.
Why this is correct
Utilizing AWS Systems Manager Parameter Store or AWS Secrets Manager for credential storage is the recommended secure practice for Amazon ECS. Both services encrypt secrets at rest and in transit, provide robust IAM-based access control, and integrate seamlessly with ECS task definitions to inject secrets at runtime. This method ensures credentials are never exposed in plain text within the task definition or container image, leveraging the task's IAM role for secure, on-demand retrieval and supporting features like automatic rotation with Secrets Manager.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.