A company runs a payment application on Amazon EC2 instances behind an Application Load Balance. The EC2 instances run in an Auto Scaling group across multiple Availability Zones. The application needs to retrieve application secrets during the application startup and export the secrets as environment variables. These secrets must be encrypted at rest and need to be rotated every month. Which solution will meet these requirements with the LEAST development effort?

Question

Accepted Answer

D. Store the secrets in AWS Secrets Manager. Provision a new customer master key. Use the key to AWS Secrets Manager natively supports scheduled automatic secret rotation using Lambda functions, encrypts secrets at rest with a customer-managed KMS key, and allows EC2 instances to retrieve secrets at startup via the Secrets Manager API. This satisfies encryption, rotation, and startup retrieval requirements without custom scheduling or rotation code.

Answer

A. Save the secrets in a text file and store the text file in Amazon S3. Provision a customer managed Storing secrets in a plaintext S3 file is insecure at the application layer even with SSE; S3 also has no built-in secret rotation mechanism.

Answer

B. Save the secrets as strings in AWS Systems Manager Parameter Store and use the default AWS Systems Manager Parameter Store SecureString supports KMS encryption but does not have built-in automatic rotation like Secrets Manager, requiring custom rotation logic.

Answer

C. Save the secrets as base64 encoded environment variables in the application properties. Base64 encoding environment variables in application properties is not encryption and exposes secrets in plaintext to anyone who can read the configuration.

A company runs a payment application on Amazon EC2 instances behind an Application Load Balance. The EC2 instances run in an Auto Scaling group across multiple Availability Zones. The application…

Question

Options

How the community answered

Why each option

Community Discussion