SAA-C03 practice question: Secrets management (2 of 2)
Design Secure Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company runs 12 microservices that share about 400 configuration values, such as feature flags, service URLs and third-party API tokens.
Every value is under 1 KB, and values are organized by environment and service, such as /prod/billing/. The API tokens must be encrypted with AWS KMS. Each service must be able to read only its own values, and none of the values needs automatic rotation.
Which solution is MOST cost-effective?
Choose one answer.
AA. Store each value as a separate secret in AWS Secrets Manager, named by path such as /prod/billing/, with IAM policies that match each service's prefix.
BB. Store the values in Parameter Store as standard-tier parameters, using SecureString for the tokens, with IAM policies scoped to each service's path.
CC. Store the values in Parameter Store as advanced-tier parameters, using SecureString for the tokens, with IAM policies scoped to each service's path.
DD. Store one secret per environment in AWS Secrets Manager that holds all the values as JSON, and give every service read access to its environment's secret.
Show the answer and explanation
Answer: B
A. Wrong: This works and is encrypted, but Secrets Manager charges for every secret each month, so 400 secrets add a steady cost. Its main extra, managed rotation, is not needed here. Parameter Store standard parameters cost nothing extra. Learn more: AWS Secrets Manager pricing (opens in a new tab)
B. Right: Correct. Standard parameters have no additional charge and allow values up to 4 KB, which covers these values. SecureString encrypts the tokens with KMS, and IAM policies on the parameter path limit each service to its own values. Learn more: Choosing parameter tiers in Parameter Store (opens in a new tab)
C. Wrong: This meets the security needs, but advanced parameters are charged, and their extras (8 KB values, parameter policies, more parameters) are not needed. An advanced parameter also cannot be changed back to standard. The standard tier is cheaper. Learn more: Choosing parameter tiers in Parameter Store (opens in a new tab)
D. Wrong: This cuts the number of secrets, but every service could read every other service's values, including their API tokens. That breaks the rule that each service reads only its own values. Path-scoped Parameter Store parameters meet it. Learn more: What is AWS Secrets Manager? (opens in a new tab)
Explanation
Parameter Store standard parameters have no additional charge, hold values up to 4 KB, support hierarchies such as /prod/billing/ and can be encrypted with KMS as SecureString. IAM policies can grant access by path. Secrets Manager charges per secret and is worth it mainly for managed rotation, and advanced parameters are charged for features not needed here.
Want more on Secrets management? The 5 full-length practice sets have 10 more Secrets management questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →