An AI application uses an external API secret.
Rotate it without unnecessary downtime and limit leakage.
Choose two practices.
Store secrets in a managed service, retrieve them with limited permission, and operate rotation, overlap, monitoring, and emergency revocation.
Detailed explanation
Updates and emergency invalidation are operable.
Secrets are separated from source and images.
Runtime diagnostics can expose them.
Blast radius and recovery cost grow.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets Manager公式のローテーション、IAM、監査とAIF-C01 Domain 5.1を確認する。
Official references
What to confirm
API秘密情報を保管・取得・更新・失効のライフサイクルで管理できる。
Key points
- Secrets Manager
- Rotation
- Revocation
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Secrets Manager
A managed service for storing, retrieving, and rotating secrets such as passwords and API keys.
Secret rotation
Replacing a credential with a new value while updating dependent applications safely.