Secrets and sensitive data: DVA-C03 study notes and practice questions

What to know for the exam

These questions give you a secret, a log, or a data set with personal information, then ask where the value should live, how it should be read, or how it should be hidden. Decide first whether the value needs rotation and whether it must be kept out of logs.

Secrets Manager or Parameter Store

Secrets Manager stores credentials and other secrets. It can rotate database and API credentials on a schedule with a rotation function, and it keeps earlier versions so an application can use the previous value during a switch. Use it when rotation is needed or when the secret is a credential for a database or service.

Systems Manager Parameter Store stores configuration. A SecureString parameter is encrypted with a KMS key. Use it for values that change between environments, such as endpoints and keys, and that do not need automatic rotation. Large values may need the advanced tier.

Rotation writes the new value under the AWSPENDING staging label, tests it, then moves AWSCURRENT to it and keeps the old one as AWSPREVIOUS; reads without a label get AWSCURRENT. The alternating users strategy avoids the short window where single user rotation can refuse logins. Amazon RDS can also manage a master user password in Secrets Manager and rotate it with no rotation function to write.

A SecureString is returned encrypted unless the request asks for decryption (WithDecryption), and the caller needs kms:Decrypt. The standard tier allows values up to 4 KB; the advanced tier allows 8 KB and parameter policies, for a charge.

Both services encrypt with KMS. Share a secret across accounts with a resource policy and a customer managed key whose key policy allows the reader; the AWS managed aws/secretsmanager key cannot be used across accounts. In ECS, secrets named in the task definition are read with the task execution role, not the task role.

Reading secrets safely

• Read secrets at run time from the SDK, not from source code or build files.
• Cache the value briefly and refresh it on rotation. In Lambda, the AWS Parameters and Secrets Lambda Extension caches secrets and parameters for the function.
• Environment variables on Lambda are encrypted at rest, but anyone who can read the function’s configuration can see the plain value in the console. Put a secret there only if that visibility is acceptable, or encrypt the value with a customer managed key before you set it.

Identifying and masking PII and PHI

Personal data such as names, email addresses, card numbers and health record numbers must be found before it can be protected. For application logs in CloudWatch Logs, a data protection policy on a log group can audit and mask sensitive data. Managed data identifiers detect common types, and custom identifiers can match your own formats. A policy can audit (report findings to a log stream) and mask (replace the value in the log view). Masked values show as asterisks. Only users with the unmask permission can see the original text.

Amazon Macie finds PII in S3 buckets, and Amazon Comprehend detects and redacts PII in free text.

Masking does not stop a value being written first, so the safest design is not to log it.

How to choose

Common traps

• Storing a secret in a Lambda environment variable and assuming console users cannot see it.
• Using Parameter Store for a credential that must rotate automatically.
• Writing a rotation schedule with the app still reading an old cached value.
• Expecting masking to change what was written before the policy existed.
• Choosing a scanner script for PII in S3 when Macie does the job.

Side by side: Secrets Manager vs Parameter Store

Try the 3 practice questions ↓