Exams / SAP-C03 / Study guide / Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager)
Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager): SAP-C03 study notes and practice questions
What to know about Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager) for the SAP-C03 exam, from the Operational Excellence and Automation domain (20% of the exam guide), then 2 free questions to test it. Part of the SAP-C03 study guide.
SAP-C03 asks where to enforce a rule so non-compliant infrastructure never reaches production, how to catch and fix drift, and how to pass secrets into IaC without exposing them.
Where each control acts
Stage
Control
Effect
Authoring and synthesis
CDK aspects, CloudFormation Guard in the pipeline
Visit every construct and add an error or warning, or change it (for example, turn on encryption)
Before provisioning
CloudFormation Hooks
Inspect resources, stacks or change sets; fail the operation or only warn
At the API
SCPs (and RCPs for resources)
Deny actions no matter how they are made, console or IaC
After deployment
AWS Config rules with remediation
Detect non-compliance and drift, then fix it with Systems Manager Automation
CloudFormation Hooks
Hooks run before resources are created or updated and can target resources, stacks, change sets and Cloud Control API operations.
Write the logic as Guard rules, a Lambda function, or a custom hook; or use AWS Control Tower proactive controls, which are managed hooks.
A hook can fail the operation or warn and continue, which lets you roll a new rule out in warn mode first.
Drift
CloudFormation drift detection finds manual changes to stack resources; the Config managed rule cloudformation-stack-drift-detection-check reports drifted stacks continuously.
Config remediation with Systems Manager Automation runbooks fixes non-compliant resources automatically or after approval.
Organization Config rules and conformance packs apply the same rules to every account.
Prevent the drift in the first place: SCPs deny changes outside the deployment role.
Secrets in IaC
Dynamic references resolve at deploy time: {{resolve:secretsmanager:...}}, {{resolve:ssm:...}} and {{resolve:ssm-secure:...}} (SecureString, supported only for some resource properties).
Let the service own the secret: an AWS::SecretsManager::Secret with GenerateSecretString and a RotationSchedule, or RDS and Aurora managed master user passwords, so nobody ever sees the value.
In the CDK, reference secrets with SecretValue, which renders a dynamic reference rather than the plain value.
Secrets Manager gives rotation, cross-Region replication and resource policies; Parameter Store is cheaper for configuration and simple SecureStrings without built-in rotation.
Cross-account secrets need a resource policy and a customer managed KMS key; the AWS managed key can’t be shared.
How to choose
Scenario wording
Choose
“Block non-compliant resources before CloudFormation creates them”
CloudFormation Hook (or Control Tower proactive control)
“Developers should see violations when they synthesize”
CDK aspects or Guard in the pipeline
“No one may disable CloudTrail, whatever tool they use”
SCP
“Detect and auto-correct manual changes”
Config rule with automatic remediation
“Database password must never appear in templates or code”
Secrets Manager generated secret or RDS managed password, dynamic reference
Common traps
Plain-text passwords as template parameters: NoEcho masks output but doesn’t stop the value leaking through other paths.
Detective Config rules when the scenario says prevent.
Hooks only, when resources are also created outside CloudFormation; pair them with SCPs and Config.
Parameter Store when the scenario requires automatic rotation.
Turning on a new hook in fail mode organization-wide without a warn-mode trial.
A bank's platform team deploys infrastructure with CloudFormation templates written by 25 product teams. A recent template created an S3 bucket that used the default SSE-S3 encryption instead of the required customer managed KMS key, and the security team wants that class of mistake blocked before any resource is created, not found afterwards.
Some teams also deploy with the AWS CDK, and the control must cover every stack in every account. The security team also wants a regular check that resources have not drifted from their approved settings.
Which solution meets these requirements?
Choose one answer.
AA. Create an AWS Config rule that flags S3 buckets whose default encryption does not use a customer managed KMS key, and enable automatic remediation that sets the required key on each bucket the rule finds.
BB. Write a CDK aspect that checks every S3 bucket in the synthesized templates, and require all 25 teams to run their CDK apps through a shared pipeline that enforces the aspect.
CC. Create a CloudFormation Hook that fails the creation of S3 buckets whose default encryption does not use a customer managed KMS key, activate it in every account and Region, and run drift detection on a schedule.
DD. Add an SCP that denies s3:CreateBucket for every principal in the organization, and have teams request each bucket from the security team through a ticket.
Show the answer and explanation
Answer: C
A. Wrong: The rule and remediation act after the bucket exists, which is the step the security team wants to move earlier. The bucket would exist briefly without encryption, and the rule does not check the template before deployment.
B. Wrong: The aspect covers CDK apps only, and the teams that deploy raw CloudFormation templates would not be checked. The security team needs the control to cover every stack.
C. Right: Correct. A CloudFormation Hook runs during deployment and fails the operation before the bucket is created, and it applies to stacks however they were authored, including CDK output. Scheduled drift detection finds resources changed after deployment.
D. Wrong: The deny blocks all buckets, which stops the teams' work instead of enforcing the encryption setting. The option also replaces the control with a manual request process.
Explanation
A CloudFormation Hook blocks non-compliant resources during deployment for every stack, including those synthesized by the CDK, and drift detection finds later changes. Config remediation acts after creation, CDK aspects miss raw templates, and a blanket SCP blocks legitimate buckets.
A hospital group's CloudFormation templates create an Amazon RDS database and the application that connects to it. Security found that a database password was typed into a template parameter default and committed to the source repository.
The group wants no secret in any template or repository, the password must rotate automatically every 30 days, and the application must receive the credentials at run time without a redeploy after each rotation.
Which solution meets these requirements?
Choose one answer.
AA. Keep the password in a NoEcho parameter, and have the pipeline pass the value from a CI variable each time it deploys the stack.
BB. Store the password in AWS Secrets Manager with 30-day rotation, reference it in the template with a dynamic reference, and have the application read the current secret when it connects.
CC. Store the password as a plain String parameter in AWS Systems Manager Parameter Store, and keep the parameter's value in the repository's parameter file so that the template can reference it.
DD. Generate a random password in the template with a custom resource, and write it to the application's environment variables at deploy time.
Show the answer and explanation
Answer: B
A. Wrong: NoEcho hides the value in the console output but not from the pipeline configuration. The password would not rotate automatically, and each rotation would need a redeploy.
B. Right: Correct. Secrets Manager rotates the password on the schedule and keeps it out of the templates, and the dynamic reference resolves the secret during deployment. The application reads the current secret at run time, so no redeploy is needed after each rotation.
C. Wrong: A String parameter is not encrypted, and keeping the value in a repository file repeats the original problem. The option also does not rotate the password.
D. Wrong: The password would be generated at each deploy and written to environment variables, so rotation means redeploying. Environment variables also spread the value to every place that reads the configuration.
Explanation
Secrets Manager rotation keeps the password out of templates and repositories, and a dynamic reference resolves it at deployment while the application reads the current secret. NoEcho, plain parameters and deploy-time generation each leave the secret in a repository or pipeline, or tie rotation to a redeploy.
Want more on Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager)? The 5 full-length practice sets have 6 more Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager)