Credentials and secrets: DEA-C01 study notes and practice questions
What to know about Credentials and secrets for the DEA-C01 exam, from the Data Security and Governance domain (18% of the exam guide), then 2 free questions to test it. Part of the DEA-C01 study guide.
Secrets questions ask where to keep credentials and how to rotate them with least operational effort.
Choosing a store
Need
Use
Database credentials with automatic rotation
AWS Secrets Manager
Configuration values, or secrets without rotation, at low or no cost
Systems Manager Parameter Store (SecureString encrypted with KMS)
Encryption keys
AWS KMS
TLS certificates
AWS Certificate Manager
Secrets Manager
Managed rotation for RDS, Aurora, Redshift and DocumentDB; Lambda rotation functions for others.
Encrypted with KMS; access controlled by IAM and resource policies (useful across accounts).
Versioning with staging labels (AWSCURRENT, AWSPREVIOUS) so apps keep working during rotation.
Can replicate secrets to other Regions.
Integrations: Glue connections, Redshift (including managing the admin password), DMS endpoints, EMR, MWAA connections and Lambda through the Parameters and Secrets extension with caching.
Good practice
Never put secrets in code, job parameters, environment variables in plain text or notebooks.
Prefer IAM authentication where the service offers it (RDS IAM auth, Redshift GetClusterCredentials or IAM identity, the Redshift and RDS Data APIs) so no password exists.
Give each job its own secret and grant secretsmanager:GetSecretValue only on that secret.
Cache secrets to cut API calls and cost.
Common traps
Parameter Store when rotation is required. Secrets Manager rotates; Parameter Store doesn’t.
Hardcoded passwords in a Glue script.
Rotation breaking a long-running app that read the secret once; read it again on authentication failures.
Sharing one admin secret across every job. A leaked or rotated secret then affects all of them; give each job its own least-privilege credentials.
A ticket reseller runs an AWS Lambda function that enriches each batch of sale events by calling a partner API. The function reads the partner's API key from AWS Secrets Manager on every invocation, and at peak it runs thousands of times a minute.
Secrets Manager API costs have grown, and some reads are throttled. The key rotates monthly, so the function must pick up a new value within a few minutes, and the team does not want to write its own caching code.
Which solution meets these requirements?
Choose one answer.
AA. Copy the API key into an environment variable on the function at each deployment, and stop reading Secrets Manager at run time.
BB. Add the AWS Parameters and Secrets Lambda Extension as a layer, and read the key from its local endpoint with a short cache TTL.
CC. Request a higher Secrets Manager API quota, and keep calling GetSecretValue on every invocation of the function.
DD. Move the key into a DynamoDB table, and read it with a strongly consistent GetItem call on every invocation of the function.
Show the answer and explanation
Answer: B
A. Wrong: The function would keep the old key after each rotation until someone redeploys it. The key would also be visible to anyone who can view the function's configuration.
C. Wrong: A higher quota may reduce throttling, but every invocation still makes a billable API call. The cost the team wants to cut keeps growing with traffic.
D. Wrong: Every invocation would still make a remote call, now billed as DynamoDB reads. The key would also lose Secrets Manager's rotation, so the monthly change would become manual work.
Explanation
Reading a secret on every invocation adds API cost and can be throttled at high volume. The AWS Parameters and Secrets Lambda Extension caches the value in the execution environment for a configurable TTL, so the function makes few calls and still sees a rotated key within minutes. Environment variables, higher quotas and a DynamoDB copy either miss rotations or keep the per-call cost.
A market-research firm runs 60 data pipelines, and each pipeline needs a handful of configuration values. Some values are sensitive, such as the API keys for three data vendors, but none of the keys has to rotate automatically. The team wants the lowest cost for storing about 300 values, and the values must be encrypted at rest and readable only by each pipeline's role.
Which solution meets these requirements?
Choose one answer.
AA. Store each value as a separate AWS Secrets Manager secret, and turn on rotation for every one of them.
BB. Store the values as plain-text objects in one S3 bucket, and rely on the bucket's default encryption and a shared read policy for all pipelines.
CC. Store each value as a SecureString parameter in Parameter Store, encrypted with KMS, with read access per pipeline path.
DD. Write the values into each pipeline's environment variables in the CloudFormation template, so they are not stored in any service.
Show the answer and explanation
Answer: C
A. Wrong: Secrets Manager charges for each secret, so 300 secrets cost far more than the team needs. Rotation adds Lambda work for keys that do not need to change, which the team does not want.
B. Wrong: Plain-text objects are not designed for secrets, and a shared read policy lets every pipeline read every value. The option fails the per-role access requirement.
C. Right: Correct. SecureString parameters are encrypted with KMS and cost less than a Secrets Manager secret for each value, and they fit values that do not rotate. Per-path IAM policies keep each pipeline's values separate. Learn more: AWS Systems Manager Parameter Store (opens in a new tab)
D. Wrong: Values in templates are visible to anyone who can read the stack, and they are stored in plain text in the template. The option fails both the encryption and access requirements.
Explanation
Parameter Store SecureString parameters encrypt sensitive values with KMS and cost much less than a Secrets Manager secret for each value. Secrets Manager's automatic rotation is worth paying for only when a credential must change on a schedule, which these keys do not. Per-path policies keep each pipeline's values to itself, while plain files and templates expose the values.
Want more on Credentials and secrets? The 5 full-length practice sets have 9 more Credentials and secrets questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →