Protect a database password and provide it to an application.
Keep secret storage and cryptographic-key management as separate service responsibilities.
Choose TWO correct statements.
Use Secrets Manager for the database password and AWS KMS for encryption-key management and authorization.
Detailed explanation
KMS manages cryptographic keys and authorizes operations such as encryption and decryption.
KMS manages cryptographic keys and authorizes operations such as encryption and decryption.
Secrets Manager provides a managed store and retrieval path for application secrets.
Secrets Manager provides a managed store and retrieval path for application secrets.
Combining both secrets in plaintext removes their protection boundaries.
Combining both secrets in plaintext removes their protection boundaries.
Broad permissions violate least privilege and expose unrelated secrets.
Broad permissions violate least privilege and expose unrelated secrets.
Check official documentation
Compare the following points with the official documentation.
AWS Secrets ManagerとKMSの公式説明を確認する。
What to confirm
秘密情報ストアと暗号鍵管理の役割を区別できる。
Key points
- Secrets Manager
- AWS KMS
- Least privilege
Notes
- Environment: AWS公式Secrets Manager・KMSドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Service responsibility
Secrets Manager handles secret lifecycle while KMS handles key lifecycle and cryptographic authorization.
Independent boundaries
Separate services and permissions reduce the impact of exposing one type of sensitive value.