SCS-C03 · Question #141
A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The…
The correct answer is A. Use a dynamic reference in the CloudFormation template to reference the database credentials in. AWS CloudFormation dynamic references provide a secure mechanism for retrieving sensitive values from AWS Secrets Manager at stack creation or update time. According to the AWS Certified Security - Specialty documentation, dynamic references ensure that sensitive data such as…
Question
A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which solution will meet the requirements?
Options
- AUse a dynamic reference in the CloudFormation template to reference the database credentials in
- BUse a parameter in the CloudFormation template to reference the database credentials. Encrypt
- CUse a SecureString parameter in the CloudFormation template to reference the database
- DUse a SecureString parameter in the CloudFormation template to reference an encrypted value in
How the community answered
(23 responses)- A74% (17)
- B4% (1)
- C9% (2)
- D13% (3)
Explanation
AWS CloudFormation dynamic references provide a secure mechanism for retrieving sensitive values from AWS Secrets Manager at stack creation or update time. According to the AWS Certified Security - Specialty documentation, dynamic references ensure that sensitive data such as database credentials are never stored in plaintext in CloudFormation templates, parameters, stack metadata, or logs. When a dynamic reference to Secrets Manager is used, CloudFormation retrieves the secret value at runtime and passes it securely to the resource that requires it. The secret value is not exposed to users who view the template, stack, or change sets.
Topics
Community Discussion
No community discussion yet for this question.