An application needs a database password.
Keep plaintext out of code and AMIs and rotate the secret regularly.
Which design is most appropriate?
Store the password in AWS Secrets Manager, restrict retrieval to the application's role, and configure rotation rather than distributing a plaintext value.
Detailed explanation
An AMI or its logs can expose the plaintext secret.
An AMI or its logs can expose the plaintext secret.
Broad administrator permissions violate least privilege.
Broad administrator permissions violate least privilege.
Secrets in source history can be exposed and are difficult to revoke safely.
Secrets in source history can be exposed and are difficult to revoke safely.
Secrets Manager protects the secret and supports access control and automatic rotation.
Secrets Manager protects the secret and supports access control and automatic rotation.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets Managerのシークレット保存・取得・ローテーションの公式説明を確認する。
What to confirm
秘密情報をコードやAMIから分離し、最小権限で取得する設計を説明できる。
Key points
- AWS Secrets Manager
- Least privilege
- Secret rotation
- Application role
Notes
- Environment: AWS公式Secrets Managerドキュメントの確認
- Confirm current AWS service behavior and security guidance in the official documentation.
Foundation review
Secret lifecycle
Secure storage, controlled retrieval, rotation, and audit form one lifecycle rather than a one-time copy.
Exposure surface
Source repositories, AMIs, and logs can persist plaintext longer than intended.