DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store the secret in an environment variable in the user data script.

  Why it's wrong here

  Storing secrets directly in environment variables via user data scripts is highly insecure. These variables are easily discoverable by any process on the EC2 instance, often visible in /proc/self/environ for running processes, and can be logged by various system services or monitoring tools. This method also lacks rotation capabilities and makes credential management cumbersome and prone to exposure.

• ✓

  Use an IAM role attached to the EC2 instance with permissions to access the secret, and call the AWS SDK to retrieve it at runtime.

  Why this is correct

  Attaching an IAM role to an EC2 instance provides a secure and scalable way to grant temporary, automatically rotated credentials to applications running on the instance. The application can then use the AWS SDK to programmatically retrieve the secret from AWS Secrets Manager at runtime, ensuring secrets are never hardcoded or stored persistently on the instance. This approach adheres to the principle of least privilege and eliminates the need for manual credential management.

• ✗

  Retrieve the secret at application startup and store it in a configuration file.

  Why it's wrong here

  Retrieving a secret at application startup only to store it in a local configuration file on disk introduces a significant security vulnerability. Any unauthorized user or process gaining access to the EC2 instance's file system could potentially read this file, exposing the sensitive database credentials. This method negates the benefits of Secrets Manager by creating a persistent, unencrypted secret artifact on the host.

• ✗

  Download the secret from an S3 bucket using pre-signed URLs.

  Why it's wrong here

  While S3 pre-signed URLs offer temporary access, using them to distribute database secrets is an anti-pattern when AWS Secrets Manager is available. Managing the generation, distribution, and expiration of pre-signed URLs for each instance or application adds unnecessary operational complexity and increases the risk of accidental exposure if URLs are mishandled or logged. Secrets Manager is purpose-built for secure secret storage and retrieval, offering superior management and auditing capabilities.