Secrets management: SAA-C03 study notes and practice questions
What to know about Secrets management for the SAA-C03 exam, from the Design Secure Architectures domain (30% of the exam guide), then 2 free questions to test it. Part of the SAA-C03 study guide.
Any scenario with a database password in code, in a config file or in an environment variable is asking you to move it into a managed secret store. The question is which one.
Secrets Manager vs Parameter Store
AWS Secrets Manager
Systems Manager Parameter Store
Built for
Credentials that must rotate
Configuration values and simple secrets
Rotation
Built in on a schedule; AWS provides rotation functions for RDS, Aurora, Redshift and DocumentDB
None built in
Encryption
Always, with KMS
Optional, as a SecureString with KMS
Cost
Per secret per month, plus API calls
Standard parameters have no extra charge; advanced parameters cost per parameter
Size
Up to 64 KB
4 KB standard, 8 KB advanced
Cross-account
Resource policy on the secret
Advanced parameters can be shared through AWS RAM
Multi-Region
Replica secrets in other Regions
No
Key facts
RDS and Aurora can manage the master password for you in Secrets Manager, including rotation, with a single setting.
Rotation strategies:single user changes the password of one user (with a brief window where old connections fail), alternating users keeps two users and switches between them so there’s always a valid credential.
Applications fetch the secret at runtime with an IAM role. Caching the value in the application, with the AWS-provided caching libraries, cuts API calls and latency.
Parameter Store hierarchies such as /prod/billing/db-url let IAM policies grant access by path.
How to choose
“Rotate automatically every 30 days” or “rotate without code”: Secrets Manager.
“Store configuration and a few secrets at the lowest cost”, no rotation needed: Parameter Store (SecureString for the secrets).
“The same secret in a second Region for disaster recovery”: Secrets Manager replica secrets.
Common traps
Storing secrets in Lambda environment variables or user data. They’re visible to anyone who can read the configuration.
Writing a custom Lambda function to rotate RDS passwords. Secrets Manager already provides one, so it fails “least operational overhead”.
Choosing Secrets Manager when the requirement is lowest cost and no rotation. Parameter Store standard parameters are free.
A company's order service runs on Amazon EC2 and connects to an Amazon RDS for MySQL database as a dedicated application user. The password is hard-coded in the application.
An audit now requires the password to be stored encrypted, changed automatically every 30 days, and never left out of date in the application after a change.
The team wants to write as little custom code as possible.
Which solution meets these requirements?
Choose one answer.
AA. Store the password as a Parameter Store SecureString, and have a scheduled Lambda function change it in the database every 30 days.
BB. Store the password as an advanced-tier SecureString parameter in Parameter Store, with a parameter policy that sets an expiration after 30 days.
CC. Store the password in Secrets Manager, rotate it every 30 days with the AWS-provided MySQL rotation function, and read the secret when connecting.
DD. Store the password in Secrets Manager with 30-day rotation turned on, and have the release pipeline copy the value into the application's config file.
Show the answer and explanation
Answer: C
A. Wrong: SecureString parameters are encrypted with AWS KMS, so storage is covered. Parameter Store has no built-in rotation, though, so the team would have to write, test and maintain the function that changes the password in MySQL and in the parameter. Secrets Manager supplies that rotation logic. Learn more: Assigning parameter policies in Parameter Store (opens in a new tab)
B. Wrong: Parameter policies do not change values. An Expiration policy deletes the parameter at the set time, and the notification policies only send EventBridge events. The password in the database would never change, and the application would lose its copy. Learn more: Assigning parameter policies in Parameter Store (opens in a new tab)
C. Right: Correct. Secrets Manager encrypts the secret and provides ready-made rotation function templates for Amazon RDS for MySQL, so no rotation code needs to be written. Because the application reads the secret when it opens connections, it always uses the current password. Learn more: AWS Secrets Manager rotation function templates (opens in a new tab)
D. Wrong: Rotation would work, but the application would keep the value from its last release. After the next rotation, the config file holds an old password and new connections fail. The application must read the secret from Secrets Manager at run time. Learn more: Rotate AWS Secrets Manager secrets (opens in a new tab)
Explanation
Secrets Manager is built for credentials that must rotate. For an RDS for MySQL user it offers AWS-provided rotation functions (single user or alternating users), so a 30-day schedule needs no custom code. The other half of the requirement is on the application side: it must read the secret at run time, not copy it into configuration, or it falls out of date after the first rotation.
A company runs 12 microservices that share about 400 configuration values, such as feature flags, service URLs and third-party API tokens.
Every value is under 1 KB, and values are organized by environment and service, such as /prod/billing/. The API tokens must be encrypted with AWS KMS. Each service must be able to read only its own values, and none of the values needs automatic rotation.
Which solution is MOST cost-effective?
Choose one answer.
AA. Store each value as a separate secret in AWS Secrets Manager, named by path such as /prod/billing/, with IAM policies that match each service's prefix.
BB. Store the values in Parameter Store as standard-tier parameters, using SecureString for the tokens, with IAM policies scoped to each service's path.
CC. Store the values in Parameter Store as advanced-tier parameters, using SecureString for the tokens, with IAM policies scoped to each service's path.
DD. Store one secret per environment in AWS Secrets Manager that holds all the values as JSON, and give every service read access to its environment's secret.
Show the answer and explanation
Answer: B
A. Wrong: This works and is encrypted, but Secrets Manager charges for every secret each month, so 400 secrets add a steady cost. Its main extra, managed rotation, is not needed here. Parameter Store standard parameters cost nothing extra. Learn more: AWS Secrets Manager pricing (opens in a new tab)
B. Right: Correct. Standard parameters have no additional charge and allow values up to 4 KB, which covers these values. SecureString encrypts the tokens with KMS, and IAM policies on the parameter path limit each service to its own values. Learn more: Choosing parameter tiers in Parameter Store (opens in a new tab)
C. Wrong: This meets the security needs, but advanced parameters are charged, and their extras (8 KB values, parameter policies, more parameters) are not needed. An advanced parameter also cannot be changed back to standard. The standard tier is cheaper. Learn more: Choosing parameter tiers in Parameter Store (opens in a new tab)
D. Wrong: This cuts the number of secrets, but every service could read every other service's values, including their API tokens. That breaks the rule that each service reads only its own values. Path-scoped Parameter Store parameters meet it. Learn more: What is AWS Secrets Manager? (opens in a new tab)
Explanation
Parameter Store standard parameters have no additional charge, hold values up to 4 KB, support hierarchies such as /prod/billing/ and can be encrypted with KMS as SecureString. IAM policies can grant access by path. Secrets Manager charges per secret and is worth it mainly for managed rotation, and advanced parameters are charged for features not needed here.
Want more on Secrets management? The 5 full-length practice sets have 10 more Secrets management questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →