ExamPark
Course menuSOA-C03

Exams / SOA-C03 / Study guide / Secrets and parameters

Secrets and parameters: SOA-C03 study notes and practice questions

What to know about Secrets and parameters for the SOA-C03 exam, from the Security and Compliance domain (16% of the exam guide), then 1 free question to test it. Part of the SOA-C03 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

These questions ask where to keep credentials and configuration, and why rotation or retrieval fails.

Secrets Manager vs Parameter Store

Secrets Manager Parameter Store
Rotation Built in, on a schedule None built in
Database integration Rotation functions for RDS, Aurora, Redshift, DocumentDB; RDS can manage the master password in Secrets Manager for you No
Cost Per secret plus API calls Standard parameters free; advanced charged
Size 64 KB 4 KB standard, 8 KB advanced
Cross-account Resource policy on the secret plus KMS key access Advanced parameters via AWS RAM
Multi-Region Replica secrets No
Extras Versioning with staging labels (AWSCURRENT, AWSPENDING, AWSPREVIOUS) Hierarchies, versions, labels, parameter policies (expiration)

Rotation

  • A rotation Lambda function updates the password in the database and the secret together.
  • Single-user rotation changes one user’s password; alternating-users keeps two users so there’s always a valid one.
  • The rotation function needs network access to the database (it runs in the VPC) and to the Secrets Manager endpoint (NAT gateway or interface VPC endpoint).
  • If rotation fails, check the function’s CloudWatch Logs: usually network access, database permissions, or the KMS key policy.

Retrieval

  • Applications call the API with an IAM role and should cache values (AWS caching libraries or the Secrets Lambda extension).
  • ECS and EKS can inject secrets into containers; CloudFormation can use dynamic references.
  • Encrypted secrets and SecureString parameters need kms:Decrypt on the key.

Common traps

  • Rotation fails with timeouts: the function can’t reach Secrets Manager or the database.
  • Applications break after rotation because they cached the old value forever: refresh on authentication failure.
  • Secrets Manager when only free configuration storage is needed. Use Parameter Store.

Side by side: Secrets Manager vs Parameter Store

Try the 1 practice question

Practice Secrets and parametersTake the free practice exam

Question 1

Medium ·Link to this question (question 1)

A regional bank's loan application connects to an Amazon RDS for MySQL database with a username and password, and the application cannot be changed to another authentication method.

Auditors now require the database password to change automatically every 30 days, and the application must always fetch the current password at runtime instead of storing it in configuration files.

Which solution should a CloudOps engineer implement?

Choose one answer.

  1. A. Store the password as a Parameter Store SecureString with an Expiration parameter policy set to 30 days.
  2. B. Store the password in Secrets Manager and turn on managed rotation every 30 days.
  3. C. Encrypt the password with a customer managed KMS key and turn on automatic key rotation for the key.
  4. D. Turn on IAM database authentication for the DB instance so that the application receives a new token every 15 minutes.
Show the answer and explanation

Answer: B

Explanation

Secrets Manager is built for credentials that must rotate. Its rotation updates the password in the database and in the secret together, on a schedule, and applications fetch the current version when they need it. Parameter Store policies and KMS key rotation do not change the password itself.

Study

Want more on Secrets and parameters? The 5 full-length practice sets have 5 more Secrets and parameters questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Secrets and parameters

More Security and Compliance topics