Access keys and secrets: CLF-C02 study notes and practice questions
What to know about Access keys and secrets for the CLF-C02 exam, from the Security and Compliance domain (30% of the exam guide), then 1 free question to test it. Part of the CLF-C02 study guide.
This topic covers the different credentials in AWS and where secrets used by applications should live.
Types of credentials
Credential
Used for
Password
Signing in to the AWS Management Console
Access key (access key ID and secret access key)
Programmatic access with the AWS CLI, SDKs or APIs
Temporary security credentials
Issued when a role is assumed or a user federates; they expire automatically
Key pairs
Connecting to EC2 instances with SSH
MFA device
A second factor at sign-in
Best practices
Prefer roles and temporary credentials to long-term access keys wherever possible.
Rotate access keys regularly and delete unused ones. The IAM credential report shows when each key was last used.
Never put keys or passwords in code or in public repositories.
Use the AWS CLI’s profiles or IAM Identity Center sign-in instead of copying keys around.
Storing application secrets
Service
Best for
AWS Secrets Manager
Database passwords and API keys that need automatic rotation; charged per secret
AWS Systems Manager Parameter Store
Configuration values and simple secrets (as encrypted SecureString parameters); standard parameters have no extra charge
Both encrypt secrets with AWS KMS and control access with IAM.
Common traps
Hard-coding a database password in an application. Store it in Secrets Manager.
Secrets Manager vs Parameter Store. Automatic rotation points to Secrets Manager; low-cost configuration storage points to Parameter Store.
Sharing access keys between people or applications. Each needs its own credentials.
Ignoring a leaked key. If an access key is exposed, deactivate and delete it straight away, create a new one, and check CloudTrail for anything it was used for.
A development team wants one central place for non-secret configuration values, such as feature flags, approved AMI IDs and endpoint names.
It wants the values in a hierarchy such as /prod/app/, with no rotation and no additional charge.
Which option should it use?
Choose one answer.
AA. AWS Systems Manager Parameter Store, using standard parameters
BB. AWS Secrets Manager, with automatic rotation turned on for every value
CC. AWS Key Management Service (AWS KMS) keys, with one key alias per setting
DD. Environment variables set on each EC2 instance, with the values listed in a shared spreadsheet
Show the answer and explanation
Answer: A
A. Right: Correct. Parameter Store organizes configuration values in hierarchies such as /prod/app/, and standard parameters have no additional charge. That suits values that are not secret and do not need rotation. Learn more: AWS Systems Manager Parameter Store (opens in a new tab)
B. Wrong: Secrets Manager is built for secrets such as database credentials that need rotation. Turning rotation on for values that never change adds work with no benefit.
C. Wrong: KMS creates and controls encryption keys. It does not store configuration values, so key aliases cannot hold the settings.
D. Wrong: This works on one server, but the values live on each instance and in a spreadsheet. They are not a central, hierarchical store.
Explanation
AWS Systems Manager Parameter Store keeps configuration data and secrets as named parameters, which can be grouped in hierarchies such as /prod/app/. Standard parameters have no additional charge. Secrets Manager suits secrets that need rotation, and KMS manages keys rather than settings, so neither fits this need.
Want more on Access keys and secrets? The 5 full-length practice sets have 9 more Access keys and secrets questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →