CLF-C02 Question 102
Single answerYour development team needs to securely store and manage database credentials for an application running on Amazon EC2. They want to avoid hardcoding sensitive information in the application code. Which solution should you recommend to meet this requirement?
- A
Store the credentials in plain text in an S3 bucket with public access disabled.
- B
Use AWS Secrets Manager to store and retrieve the credentials.
- C
Store the credentials in an EC2 instance's user data script.
- D
Use AWS Systems Manager Parameter Store with encryption to manage the credentials.
Show answer and explanation
Correct answer: B
Explanation
The best solution for securely managing and retrieving sensitive information such as database credentials is AWS Secrets Manager. It is specifically designed for this purpose and offers features like secure storage, access control, and automatic secret rotation. While AWS Systems Manager Parameter Store with encryption is also an option, AWS Secrets Manager provides a more comprehensive feature set tailored for managing secrets.
- A. Incorrect.
Storing credentials in plain text in an S3 bucket is insecure, even if public access is disabled. Sensitive information should not be stored in plain text.
- B. Correct.
AWS Secrets Manager is designed to securely store and manage sensitive information such as credentials. It also provides features like automatic rotation of secrets, making it the most appropriate solution in this scenario.
- C. Incorrect.
Storing credentials in an EC2 instance's user data script is insecure and not a recommended best practice because the data could be exposed in logs or through other vulnerabilities.
- D. Incorrect.
AWS Systems Manager Parameter Store with encryption is a viable solution for storing sensitive information, but AWS Secrets Manager is specifically designed for managing secrets like database credentials and offers additional features like secret rotation.