A job in a subnet without internet egress must read Secrets Manager.
The secret retrieval path must also remain private.
Which authentication approach is most appropriate?
Create a Secrets Manager interface VPC endpoint and align private DNS, security groups, endpoint policy, and IAM.
Detailed explanation
Logs and diagnostics may expose the value.
Logs and diagnostics may expose the value.
The path is broader, internet-dependent, and adds avoidable cost.
The path is broader, internet-dependent, and adds avoidable cost.
The job reaches the service through private ENIs and access can be restricted.
The job reaches the service through private ENIs and access can be restricted.
Lifecycle does not connect a subnet to Secrets Manager.
Lifecycle does not connect a subnet to Secrets Manager.
Check official documentation
Compare the following points with the official documentation.
AWS PrivateLink interface endpoints for Secrets Manager、private DNS、endpoint policyの公式説明を確認する。
What to confirm
NAT経由・平文環境変数と、サービス別Interface Endpointの違いを説明できる。
Key points
- Interface endpoint
- Private DNS
- Secrets Manager
- Private path
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Troubleshooting
Check name resolution, routes, security groups, endpoint policy, and IAM as separate layers.
Minimize endpoints
Create endpoints only for required services and limit their allowed actions.