Development and production use different database endpoints.
Keep settings out of an AMI and source code while controlling who can read them.
Which service is most appropriate?
Store hierarchical settings in Systems Manager Parameter Store and grant the application IAM permission to read them.
Detailed explanation
DNS records are not a secure configuration store for credentials.
DNS records are not a secure configuration store for credentials.
Returning a secret in a response is an unsafe disclosure.
Returning a secret in a response is an unsafe disclosure.
Public storage creates an unnecessary exposure and leakage risk.
Public storage creates an unnecessary exposure and leakage risk.
Parameter Store stores hierarchical configuration and uses IAM permissions to control retrieval.
Parameter Store stores hierarchical configuration and uses IAM permissions to control retrieval.
Check official documentation
Compare the following points with the official documentation.
AWS Systems Manager Parameter Storeの公式説明を確認する。
What to confirm
通常パラメータとSecureStringの用途を考慮できる。
Key points
- Parameter Store
- Hierarchical parameter
- SecureString
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Configuration separation
Keeping settings outside code and images allows each environment to supply its own value.
Secret boundary
Credentials need stronger protection than ordinary non-sensitive parameters.