SAP-C02 Question 162
Single answerYour organization uses AWS CloudFormation to manage infrastructure as code. A recent security audit revealed that sensitive data, such as database passwords, is hardcoded into the CloudFormation templates. The team has been tasked with ensuring that sensitive data is securely managed moving forward. Which solution will address this requirement while adhering to best practices?
- A
Use AWS Secrets Manager and reference the secrets in the CloudFormation template using dynamic references.
- B
Encrypt the sensitive values using a custom encryption algorithm and store them in the CloudFormation template.
- C
Use AWS Systems Manager Parameter Store with parameter hierarchy and reference the parameters in the CloudFormation template.
- D
Store the sensitive data in an S3 bucket with server-side encryption enabled and directly reference the S3 object in the CloudFormation template.
Show answer and explanation
Correct answer: A
Explanation
AWS Secrets Manager is the recommended service for securely managing sensitive data, such as database passwords, in AWS. It integrates seamlessly with CloudFormation through dynamic references, ensuring that sensitive values are not hardcoded into templates. This approach adheres to the principle of least privilege and ensures security best practices.
- A. Correct.
Correct: AWS Secrets Manager is designed to securely manage sensitive information like database passwords. Using dynamic references in CloudFormation templates ensures that sensitive values are never stored in plaintext.
- B. Incorrect.
Incorrect: Implementing a custom encryption algorithm introduces unnecessary complexity and security risks. AWS provides native services like Secrets Manager for securely managing sensitive data.
- C. Incorrect.
Incorrect: While AWS Systems Manager Parameter Store can be used for storing configuration data, it is not as purpose-built for managing sensitive information as AWS Secrets Manager. Additionally, Parameter Store does not provide the same level of secret rotation and auditing.
- D. Incorrect.
Incorrect: Storing sensitive data in S3 is not a best practice for secrets management. Referencing an S3 object directly in CloudFormation templates exposes the sensitive data to potential risks, even with encryption enabled.