DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Hardcode the credentials in the application code and encrypt the code using AWS KMS.

  Why it's wrong here

  Hardcoding credentials directly into application code is a severe security anti-pattern, regardless of whether the code itself is encrypted. Even if the code repository is encrypted with AWS KMS, the plaintext credentials are still present within the source code, making them vulnerable to exposure if the repository or build artifacts are compromised. This approach also complicates credential rotation and auditability, as every change requires code modification and redeployment.

• ✓

  Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.

  Why this is correct

  AWS Systems Manager Parameter Store and AWS Secrets Manager are purpose-built services for securely storing and managing configuration data and secrets, respectively. Parameter Store offers secure string types encrypted with KMS, suitable for non-rotating secrets, while Secrets Manager provides advanced features like automatic secret rotation, fine-grained access control, and integration with various AWS services and databases. Utilizing these services centralizes secret management, enhances security, and simplifies compliance.

• ✓

  Reference the secrets in the task definition as environment variables using the 'secrets' parameter.

  Why this is correct

  Amazon ECS provides a secure mechanism to inject sensitive data into containers at runtime by referencing secrets directly within the task definition. By using the 'secrets' parameter, developers can specify the ARN of a secret stored in AWS Secrets Manager or a secure string in AWS Systems Manager Parameter Store. ECS then retrieves these secrets and injects them as environment variables into the container, preventing them from being hardcoded or exposed in the task definition itself.

• ✓

  Grant the ECS task execution role permission to read the secrets from Parameter Store or Secrets Manager.

  Why this is correct

  For an ECS task to successfully retrieve and inject secrets into its containers, the associated ECS task execution IAM role must possess the necessary permissions. Specifically, this role requires 'secretsmanager:GetSecretValue' for AWS Secrets Manager secrets or 'ssm:GetParameters' and 'kms:Decrypt' for secure strings in AWS Systems Manager Parameter Store. This adherence to the principle of least privilege ensures that only the ECS service, acting on behalf of the task, can access the specified secrets.

• ✗

  Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.

  Why it's wrong here

  Amazon Elastic Container Registry (ECR) is a managed Docker container image registry, and its tags are intended solely for identifying and versioning container images. ECR tags are plain text metadata, not encrypted, and are easily viewable by anyone with appropriate ECR permissions. Storing sensitive database credentials within ECR tags would expose them insecurely, making them highly vulnerable to unauthorized access and violating fundamental security best practices for secret management.

Go deeper

Related to this question