An AI app calls an external API and AWS services.
Keep keys and tokens out of source code and prompts.
Choose two appropriate designs.
Use roles or a secret manager and mask secrets in prompts, logs, and errors.
Detailed explanation
Protection, access control, and rotation are still required.
Long-lived keys need not be embedded in code or user input.
This reduces accidental exposure through the model and operations.
The key could be exposed through output or logs.
Check official documentation
Compare the following points with the official documentation.
AWS公式Secrets Manager・IAMとAIF-C01 Domain 5.1のAIセキュリティを確認する。
Official references
What to confirm
秘密情報をモデル入力やソースコードから分離する設計を説明できる。
Key points
- Secrets Manager
- Roles
- Masking
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
AWS Secrets Manager
A service for storing, retrieving, rotating, and controlling access to secrets.
IAM role
An identity with permissions that a trusted principal can assume, commonly for temporary access.