5.1Standard
A generation app uses one external API secret.
Other services in the account must not read it.
Choose two designs.
× Incorrect
Separate read roles by secret and application, and audit retrieval, use, rotation, failure, and deletion.
Detailed explanation
CorrectSeparate a read role per secret or purpose and grant it only to the target app
Exposure blast radius is limited.
CorrectAudit retrieval, use, rotation, and failures and remove unused secrets
The secret lifecycle is traceable.
IncorrectRetry secret failures without a limit
Outages and leaks can be amplified.
IncorrectGive every app Secrets Manager administrator access
All secrets can be read.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets Manager・IAM公式とAIF-C01 Domain 5.1の最小権限を確認する。
Official references
What to confirm
秘密管理サービスの利用と、秘密ごとの読み取り境界を設計できる。
Key points
- Secret scope
- Read role
- Audit
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Secret-scoped permission
An access grant limited to a particular secret, application, or purpose.
Secret lifecycle
The creation, retrieval, use, rotation, revocation, deletion, and auditing of a secret.
Question IDAWS-AIF-288
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue