An application needs a database password at runtime.
The value must not be hard-coded and should support rotation.
Which AWS service is primarily appropriate?
AWS Secrets Manager stores secrets, controls access, and supports retrieving and rotating credentials without putting plaintext in source code.
Detailed explanation
Logs can be viewed or retained by other principals, so plaintext credentials should not be written there.
Logs can be viewed or retained by other principals, so plaintext credentials should not be written there.
Secrets Manager is designed for protected secrets and supports controlled retrieval and rotation.
Secrets Manager is designed for protected secrets and supports controlled retrieval and rotation.
Public storage exposes the credential and provides no suitable secret lifecycle control.
Public storage exposes the credential and provides no suitable secret lifecycle control.
AMI metadata is not a secrets store and does not provide access control or rotation.
AMI metadata is not a secrets store and does not provide access control or rotation.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets Manager User GuideのWhat is AWS Secrets Manager?を確認する。実環境で利用すると料金が発生する場合がある。
What to confirm
アプリケーションが実行時にSecrets Managerから認証情報を取得し、ソースコードに平文を保存しない。
Key points
- AWS Secrets Manager
- Secret
- Rotation
Notes
- Environment: AWS公式Secrets Managerドキュメントの確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Runtime retrieval
Applications can fetch a secret when needed instead of carrying plaintext in source code.
Lifecycle control
Access policy, rotation, and recovery are part of secret management.