SAP-C03 practice question: Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager) (2 of 2)
Operational Excellence and Automation A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital group's CloudFormation templates create an Amazon RDS database and the application that connects to it. Security found that a database password was typed into a template parameter default and committed to the source repository.
The group wants no secret in any template or repository, the password must rotate automatically every 30 days, and the application must receive the credentials at run time without a redeploy after each rotation.
Which solution meets these requirements?
Choose one answer.
AA. Keep the password in a NoEcho parameter, and have the pipeline pass the value from a CI variable each time it deploys the stack.
BB. Store the password in AWS Secrets Manager with 30-day rotation, reference it in the template with a dynamic reference, and have the application read the current secret when it connects.
CC. Store the password as a plain String parameter in AWS Systems Manager Parameter Store, and keep the parameter's value in the repository's parameter file so that the template can reference it.
DD. Generate a random password in the template with a custom resource, and write it to the application's environment variables at deploy time.
Show the answer and explanation
Answer: B
A. Wrong: NoEcho hides the value in the console output but not from the pipeline configuration. The password would not rotate automatically, and each rotation would need a redeploy.
B. Right: Correct. Secrets Manager rotates the password on the schedule and keeps it out of the templates, and the dynamic reference resolves the secret during deployment. The application reads the current secret at run time, so no redeploy is needed after each rotation.
C. Wrong: A String parameter is not encrypted, and keeping the value in a repository file repeats the original problem. The option also does not rotate the password.
D. Wrong: The password would be generated at each deploy and written to environment variables, so rotation means redeploying. Environment variables also spread the value to every place that reads the configuration.
Explanation
Secrets Manager rotation keeps the password out of templates and repositories, and a dynamic reference resolves it at deployment while the application reads the current secret. NoEcho, plain parameters and deploy-time generation each leave the secret in a repository or pipeline, or tie rotation to a redeploy.
Want more on Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager)? The 5 full-length practice sets have 6 more Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →